LOWcrates.io
GHSA-333v-68xh-8mmq· CVE-2026-22782RustFS's RPC signature verification logs shared secret
Modified: 2/3/2026
package
crates.io/rustfs
pkg:crates.io/rustfs
HIGHcrates.io
GHSA-fc6g-2gcp-2qrq· CVE-2026-21862RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers
Modified: 2/3/2026
MEDIUMcrates.io
GHSA-gw2x-q739-qhcr· CVE-2025-69255RustFS gRPC GetMetrics deserialization panic enables remote DoS
Modified: 2/3/2026
CRITICAL9.8crates.io
GHSA-h956-rh7x-ppgj· CVE-2025-68926RustFS has a gRPC Hardcoded Token Authentication Bypass
Modified: 2/3/2026
HIGHcrates.io
GHSA-mm2q-qcmx-gw4wRustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover
Modified: 5/5/2026
MEDIUM4.3crates.io
GHSA-mx42-j6wv-px98· CVE-2026-39360RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration
Modified: 4/10/2026
HIGH8.3crates.io
GHSA-pfcq-4gjr-6gjm· CVE-2026-40937RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
Modified: 5/5/2026
HIGHcrates.io
GHSA-pq29-69jg-9mxc· CVE-2025-68705RustFS Path Traversal Vulnerability
Modified: 2/3/2026
MEDIUMcrates.io
GHSA-r54g-49rx-98cr· CVE-2026-24762RustFS Logs Sensitive Credentials in Plaintext
Modified: 2/22/2026
CRITICAL9.0crates.io
GHSA-v9fg-3cr2-277j· CVE-2026-27822Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
Modified: 2/25/2026
MEDIUMcrates.io
GHSA-vcwh-pff9-64cc· CVE-2026-22042RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation
Modified: 2/3/2026
HIGH8.1crates.io
GHSA-w5fh-f8xh-5x3p· CVE-2026-27607RustFS: Missing Post Policy Validation leads to Arbitrary Object Write
Modified: 2/25/2026
MEDIUMcrates.io
GHSA-xgr5-qc6w-vcg9· CVE-2026-22043RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
Modified: 2/3/2026