Executive brief
RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
Affected products
- crates.io rustfs
Junglewise Threat Intelligence
CVE-2026-22043: RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
CVE-2026-22043 · Severity: medium · CVSS 4 · Published 2026-01-08
Technologies: rustfs (crates.io). Vendors: crates.io.
Related threats
- RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover
- RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
- RustFS missing authorization in multipart UploadPartCopy
- Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
- RustFS: Missing Post Policy Validation leads to Arbitrary Object Write