RustFS heeft een IAM deny_only Short-Circuit die Privilege Escalation toestaat via Service Account Minting

The impact of CVE-2026-22043 is significant, enabling privilege escalation within RustFS environments. An attacker exploiting this vulnerability can bypass session and inline policy restrictions by creating a new service account with elevated privileges. This allows them to perform actions they would otherwise be unauthorized to do, potentially leading to data breaches, system compromise, and disruption of services. The vulnerability shares similarities with MinIO CVE-2025-62506, suggesting a common underlying issue in policy evaluation logic. The blast radius extends to any service or application relying on RustFS for access control.

Organizations heavily reliant on RustFS for data storage and access control are at risk. This includes those using RustFS in multi-tenant environments or with complex IAM policies. Legacy configurations with overly permissive service account policies are particularly vulnerable.

• rust: Examine RustFS logs for unusual service account creation patterns or privilege escalation attempts. Look for requests that bypass policy checks.

# Example: Filter RustFS logs for service account creation events
zgrep 'service_account_created' /var/log/rustfs/audit.log

• generic web: Monitor RustFS API endpoints for suspicious requests related to IAM operations.

# Example: Use curl to check for unauthorized access attempts
curl -v https://rustfs.example.com/iam/create_service_account -H "Authorization: Bearer <restricted_token>"

1. 2026-01-08Disclosure

   disclosure

1. Gereserveerd2026-01-05
2. Gepubliceerd2026-01-08
3. Gewijzigd2026-02-03
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-22043 is to upgrade RustFS to version 1.0.0-alpha.79 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Review and restrict the permissions granted to service accounts, particularly those with the ability to create new accounts. Implement stricter auditing and monitoring of service account creation and privilege escalation attempts. While a WAF or proxy cannot directly address this IAM vulnerability, they can help detect and block suspicious activity related to privilege escalation. After upgrading, confirm the fix by attempting to create a new service account with a restricted policy and verifying that the account inherits only the intended permissions.