PT-2026-44470 · Rustfs · Rustfs

Mr-In4Inci3Le · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-45042

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.2

Description Improper authorization in the UploadPartCopy operation allows copying objects across buckets without enforcing destination bucket restrictions on allowed copy sources. The system validates GetObject permission on the source bucket and PutObject on the destination bucket independently, but fails to enforce policy constraints regarding whether the destination bucket permits the specified copy source, enabling unauthorized cross-bucket data movement.

Recommendations Update to version 1.0.0-beta.2.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-45042

Affected Products

Rustfs

References · 3

• 🔥 https://github.com/rustfs/rustfs/security/advisories/GHSA-wfxj-ph3v-7mjf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45042 · Security Note
• https://twitter.com/CVEnew/status/2060091941224620410 · Twitter Post