PT-2026-21835 · Rustfs · Rustfs

Nikeee · Published 2026-02-20 · Updated 2026-03-02 · CVE-2026-27607

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.56 through 1.0.0-alpha.82

Description RustFS does not properly validate policy conditions during presigned POST uploads (PostObject). This allows bypassing content-length-range, starts-with, and Content-Type constraints. Successful exploitation can lead to unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing. These actions could result in storage exhaustion, unauthorized data access, and security bypasses. The PostObject function is involved in this issue.

Recommendations Update to RustFS version 1.0.0-alpha.83 or later.

Exploit

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-20

CWE-863

Related Identifiers

BDU:2026-05083

CVE-2026-27607

GHSA-W5FH-F8XH-5X3P

Affected Products

Rustfs

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27607.json · Exploit
• 🔥 https://github.com/nikeee/CVE-2026-27607 · Exploit
• https://github.com/rustfs/rustfs/security/advisories/GHSA-w5fh-f8xh-5x3p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27607 · Security Note
• https://osv.dev/vulnerability/GHSA-w5fh-f8xh-5x3p · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05083 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27607 · Vendor Advisory
• https://github.com/rustfs/rustfs · Note
• https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.83 · Note
• https://twitter.com/CveTodo/status/2026499563670908966 · Twitter Post
• https://twitter.com/CVEnew/status/2026641378453676124 · Twitter Post
• https://twitter.com/cracbot/status/2028425188279464375 · Twitter Post
• https://twitter.com/_cvereports/status/2026857329535099251 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026596694800920706 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rfmr6l/resumen_diario_de_vulnerabilidades_26022026 · Reddit Post