Description

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled target_user after only checking CreateServiceAccountAdminAction, passes it to new_service_account, and prepare_service_account_auth sets is_owner for the resulting root-parent service account. This issue is fixed in version 1.0.0-beta.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T15:18:31.437Z",
  "pubdate": "2026-08-12T15:18:31.437Z",
  "executiveSummary": "An improper authorization vulnerability exists in the RustFS distributed object storage system, specifically within the service account management functionality.\nThe flaw resides in the AddServiceAccount handler located in rustfs/src/admin/handlers/service_account.rs, where attacker-controlled input specifying the target_user parameter is processed after validating only the CreateServiceAccountAdminAction.\nUpon receiving this input, the system passes the parameter directly to new_service_account, and prepare_service_account_auth subsequently assigns ownership privileges (is_owner) to the resulting root-parent service account.\nThis architectural deficiency allows authenticated attackers with lower-tier administrative privileges to provision service accounts with unintended root-level permissions, leading to severe unauthorized privilege escalation and complete compromise of the distributed object storage infrastructure.\nThe vulnerability affects RustFS versions prior to 1.0.0-beta.11 and requires specific administrative action validation bypass capabilities during the attack lifecycle.",
  "technicalDetails": "The vulnerability is rooted in flawed access control logic and inadequate parameter validation within the administration subsystem of RustFS.\nThe vulnerable component is identified as the AddServiceAccount function implemented in rustfs/src/admin/handlers/service_account.rs.\nDuring the execution flow, the handler processes incoming requests to create new service accounts.\nThe authorization check implemented prior to processing only validates that the requesting entity possesses the CreateServiceAccountAdminAction permission, failing to enforce granular checks against the specified target_user parameter supplied in the request payload.\nBecause the attacker-controlled target_user value is accepted without proper verification of scope or contextual authorization, the execution flow proceeds to invoke the new_service_account function using the manipulated identifier.\nSubsequently, the prepare_service_account_auth function processes the generated account structure and assigns the is_owner flag to the resulting root-parent service account.\nThis sequence of operations results in an elevation of privilege, where a principal capable of triggering the admin action can instantiate a service account possessing administrative ownership semantics.\nThe attack vector requires the capability to interact with the administrative API endpoints of RustFS, specifically targeting the service account creation interface.\nSuccessful exploitation allows an adversary to establish persistent, highly privileged administrative access across the distributed object storage system, bypassing intended isolation and role boundaries.\nThe vulnerability affects all versions of RustFS prior to the patched release 1.0.0-beta.11."
}