Executive brief
RustFS, a distributed storage system used for managing large-scale data objects, contains a security flaw that allows unauthorized data access. A user with limited permissions can bypass security restrictions to copy and steal private files from other users' storage buckets. This failure in tenant isolation could lead to the exposure of sensitive corporate or customer data in multi-user environments.
Technical details
A missing authorization check exists in the RustFS 'UploadPartCopy' multipart upload path. While standard 'CopyObject' operations correctly enforce source 'GetObject' and destination 'PutObject' permissions, the 'upload_part_copy', 'complete_multipart_upload', and 'abort_multipart_upload' functions in 'rustfs/src/storage/access.rs' fail open by returning 'Ok(())' without validating the requester's rights. An authenticated attacker can exploit this by initiating a multipart upload in a bucket they control and using the vulnerable 'UploadPartCopy' command to pull data from a victim's bucket into their own. This vulnerability breaks tenant isolation in multi-tenant deployments and is fixed in version alpha.90.
Affected products
- rustfs RustFS < alpha.90
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched: Fixed in version alpha.90