CVE-2026-22043— RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-22043
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
Source: NVD (National Vulnerability Database)
Vulnerability Description
RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
特权管理不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
rustfs 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
rustfs是RustFS开源的一个高性能对象存储系统。 rustfs 1.0.0-alpha.13版本至1.0.0-alpha.78版本存在安全漏洞，该漏洞源于deny_only短路逻辑缺陷，可能导致权限提升和绕过会话策略限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-22043
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22043
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: rustfs
- CVE-2026-40937
RustFS missing admin authorization on notification target en - CVE-2026-39360
RustFS has an authorization bypass in multipart UploadPartCo - CVE-2026-27822
Rust has Critical Stored XSS in Preview Modal, leading to Ad - CVE-2026-27607
RustFS's Missing Post Policy Validation leads to Arbitrary O - CVE-2026-24762
RustFS Logs Sensitive Credentials in Plaintext
Same vendor: rustfs
- CVE-2026-40937
RustFS missing admin authorization on notification target en - CVE-2026-39360
RustFS has an authorization bypass in multipart UploadPartCo - CVE-2026-27822
Rust has Critical Stored XSS in Preview Modal, leading to Ad - CVE-2026-27607
RustFS's Missing Post Policy Validation leads to Arbitrary O - CVE-2026-24762
RustFS Logs Sensitive Credentials in Plaintext
Same weakness: CWE-269
- CVE-2026-42562
Plainpad: Privilege Escalation via Writable Admin Field in P - CVE-2026-41163
bubblewrap vulnerable to privilege escalation in setuid mode - CVE-2026-44987
SysReptor: Privilege Escalation from User Admin to Superuser - CVE-2026-42185
People: Privilege Escalation via Missing Role Ceiling in Mai - CVE-2026-40001
Local privilege escalation vulnerability in ZTE PROCESS Guar
V. Comments for CVE-2026-22043
No comments yet