Description

RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content. This issue is fixed in version 1.0.0-beta.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T15:18:31.250Z",
  "pubdate": "2026-08-12T15:18:31.250Z",
  "executiveSummary": "RustFS, a distributed object storage system built in Rust, contains an authorization bypass vulnerability affecting explicit versionId read operations. Specifically, the system incorrectly validates permissions during GetObject, CopyObject sources, and UploadPartCopy sources by enforcing s3:GetObject instead of the required s3:GetObjectVersion permission.\nThis authorization flaw allows principals lacking historical-version read permissions to successfully access and disclose known historical object content. The risk implication is a breach of data confidentiality regarding versioned storage artifacts. The vulnerability can be exploited by authenticated principals with network access to the distributed object storage system who possess knowledge of specific target object version identifiers.\nThe issue affects RustFS and has been officially resolved in version 1.0.0-beta.11.",
  "technicalDetails": "The vulnerability stems from improper access control enforcement within the RustFS storage engine's permission validation logic for versioned S3 API operations. When a client issues a request containing an explicit versionId parameter targeting GetObject, or utilizes such a versioned object as a source in CopyObject and UploadPartCopy operations, the access control mechanism evaluates the request against the standard s3:GetObject permission rather than the restrictive s3:GetObjectVersion permission.\nThe vulnerable components reside within the authorization and request routing handlers responsible for parsing S3 API calls that reference historical object versions. Because the privilege verification check maps versioned requests to the incorrect IAM action namespace, principals explicitly restricted from viewing historical iterations bypass the intended security boundary.\nThe attack flow proceeds as follows: an attacker with standard s3:GetObject access—or a principal lacking historical-version privileges—discovers or guesses a valid object versionId. The attacker issues a standard GetObject request appended with the target versionId, or initiates a CopyObject or UploadPartCopy operation referencing the historical version as a source. The RustFS authorization subsystem evaluates the principal's permissions, incorrectly checks for s3:GetObject instead of s3:GetObjectVersion, grants authorization due to the presence of base object read rights, and subsequently discloses the historical object content in the API response payload.\nThe affected versions include all releases of RustFS prior to version 1.0.0-beta.11. Exploitation requires network exposure to the RustFS API endpoints, valid authentication credentials, and knowledge of specific object version identifiers."
}