PT-2026-2144 · Rustfs · Rustfs

Threonine · Published 2026-01-08 · Updated 2026-01-08 · CVE-2026-22043

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.78

Description RustFS is a distributed object storage system built in Rust. A flaw in the deny only short-circuit within RustFS IAM allows a restricted service account or STS credential to create an unrestricted service account, gaining the parent’s full privileges. This enables privilege escalation and bypasses session or inline policy restrictions. The vulnerable component is the RustFS IAM system, specifically the deny only short-circuit logic.

Recommendations Versions prior to 1.0.0-alpha.79 are affected and should be updated to version 1.0.0-alpha.79 or later.

Exploit

Fix

LPE

Insufficiently Protected Credentials

Improper Privilege Management

Improper Access Control

Weakness Enumeration

CWE-522

CWE-269

CWE-284

Related Identifiers

CVE-2026-22043

GHSA-XGR5-QC6W-VCG9

Affected Products

Rustfs

References · 8

• 🔥 https://github.com/rustfs/rustfs/security/advisories/GHSA-xgr5-qc6w-vcg9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22043.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-22043 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22043 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xgr5-qc6w-vcg9 · Vendor Advisory
• https://github.com/rustfs/rustfs · Note
• https://t.me/CVEtracker/41732 · Telegram Post
• https://twitter.com/CVEnew/status/2009291492406292516 · Twitter Post