CVE-2026-55188

RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials

State: Published
Severity: 8.2 High
Published: Jun 26, 2026
Updated: Jun 27, 2026
Reserved: Jun 16, 2026

Description

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket. Because the returned BucketTarget objects include remote target credentials, this can disclose replication access keys and secret keys. This vulnerability is fixed in 1.0.0-beta.9.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-522 Insufficiently Protected Credentials
CWE-862 Missing Authorization
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
rustfsrustfs	>= 1.0.0-alpha.1, <= 1.0.0-beta.8Affected

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-796f-j7xp-hwf4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.