Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's semantics because crates/policy/src/policy/function/string.rs negates the aggregate result after eval or eval_like instead of negating each request-value predicate before quantification. Partially overlapping policy and request value sets can therefore make an Allow condition grant access to an excluded principal or make a Deny guardrail fail, including policies based on jwt:groups and jwt:roles; absent keys also receive the opposite ForAllValues: and ForAnyValue: behavior. This issue is fixed in version 1.0.0-beta.12.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T15:18:32.733Z",
  "pubdate": "2026-08-12T15:18:32.733Z",
  "executiveSummary": "A logic vulnerability exists in RustFS prior to version 1.0.0-beta.12 affecting the evaluation of set qualifiers in access control policies.\nThe vulnerability involves the improper handling of negated string operators within the ForAllValues: and ForAnyValue: conditional qualifiers.\nDue to incorrect negation placement in the policy evaluation engine, partially overlapping policy and request value sets can cause Allow conditions to incorrectly grant access to excluded principals or cause Deny guardrails to fail.\nThis flaw impacts policies relying on claims such as jwt:groups and jwt:roles, and also causes absent keys to receive the opposite boolean behavior.\nAttackers can leverage this misevaluation by supplying crafted request values that exploit the inverted set quantifier semantics, bypassing authorization boundaries in distributed object storage environments.\nThe risk is mitigated by updating the affected software to version 1.0.0-beta.12 where the evaluation logic has been corrected.",
  "technicalDetails": "The vulnerability resides in the crates/policy/src/policy/function/string.rs file within RustFS, specifically in the logic responsible for evaluating set qualifiers alongside negated string operators.\nThe affected operators include StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike.\nThe root cause of the vulnerability is that the evaluation engine negates the aggregate result after executing eval or eval_like functions, rather than negating each individual request-value predicate prior to quantification.\nBecause of this incorrect mathematical and logical structuring, the semantics of ForAllValues: and ForAnyValue: are swapped or improperly processed when evaluating negated string comparisons.\nDuring exploitation, an attacker crafts requests with specific parameters that interact with partially overlapping policy and request value sets.\nWhen the policy engine evaluates these sets, the flawed aggregation logic improperly interprets the quantifiers, resulting in an unauthorized authorization decision.\nConsequently, an Allow condition may erroneously grant access to an explicitly excluded principal, or a critical Deny guardrail may fail to trigger.\nPolicies depending on JSON Web Token claims, such as jwt:groups and jwt:roles, are directly susceptible to this faulty evaluation.\nFurthermore, absent keys are affected by this logic flaw, receiving the exact opposite behavior intended for ForAllValues: and ForAnyValue: conditions.\nThe vulnerability affects RustFS versions prior to 1.0.0-beta.12 and requires no specialized authentication privileges beyond the ability to issue requests containing evaluated policy conditions against the distributed object storage system."
}