Description

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T15:18:31.840Z",
  "pubdate": "2026-08-12T15:18:31.840Z",
  "executiveSummary": "An authorization bypass vulnerability exists in RustFS, a distributed object storage system built in Rust, affecting versions 1.0.0-alpha.64 through 1.0.0-rc.0. The vulnerability stems from an incorrect configuration of the PreparedIamAuth.needs_existing_object_tag field when external OPA authorization is enabled via RUSTFS_POLICY_PLUGIN_URL. This misconfiguration directly impacts the maybe_merge_object_tag_conditions function within crates/iam/src/sys.rs, causing the policy evaluation engine to omit crucial s3:ExistingObjectTag/* evaluation values during authorization checks. Consequently, authenticated users can completely bypass tag-based access control policy restrictions enforced by Open Policy Agent. The risk implications include unauthorized access to sensitive object data and the circumvention of mandatory data governance controls within distributed storage environments. Exploitation requires the target system to utilize external OPA authorization and relies on the attacker holding valid authentication credentials to interact with the storage system while leveraging the flawed policy evaluation logic to bypass granular tag constraints.",
  "technicalDetails": "The vulnerability is localized within the IAM subsystem of RustFS, specifically inside the crates/iam/src/sys.rs file where external Open Policy Agent (OPA) authorization logic is implemented and managed. The root cause of the issue is an erroneous assignment within the PreparedIamAuth structure when the authorization mode is explicitly set to PreparedIamMode::Opa. Specifically, the needs_existing_object_tag boolean flag is set incorrectly, failing to signal the requirement for existing object tags during authorization evaluation cycles. Because of this incorrect state initialization, subsequent calls to the maybe_merge_object_tag_conditions function omit s3:ExistingObjectTag/* conditional values from the evaluation context passed to the external OPA policy plugin. Attack flow begins when an authenticated user attempts to perform storage operations on objects protected by tag-based AWS S3-compatible policies. The RustFS storage node intercepts the request, constructs the IAM authorization payload, and queries the external OPA plugin via the configured RUSTFS_POLICY_PLUGIN_URL. Due to the missing s3:ExistingObjectTag/* conditions in the evaluation context, the OPA policy engine renders an authorization decision based on incomplete metadata, granting access despite explicit policy rules that restrict actions based on existing object tags. Authentication is required to interact with the storage system, but no special administrative privileges are necessary; any standard authenticated user can trigger the flawed policy evaluation flow. The network exposure is tied to the distributed object storage endpoint and the internal or external network path communicating with the OPA plugin. The post-exploitation impact allows malicious or unauthorized users to read, modify, or manipulate objects that should have been strictly protected by fine-grained, tag-based security policies, thereby undermining data confidentiality and integrity guarantees within the RustFS cluster."
}