CVE-2026-39360: RustFS missing authorization in multipart UploadPartCopy

CVE-2026-39360 · Severity: medium · CVSS 4.3 · Published 2026-04-07

RustFS, a distributed storage system used for managing large-scale data objects, contains a security flaw that allows unauthorized data access. A user with limited permissions can bypass security restrictions to copy and steal private files from other users' storage buckets. This failure in tenant isolation could lead to the exposure of sensitive corporate or customer data in multi-user environments.

Technologies: rustfs (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-39360 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39360 being exploited in the wild.
How severe is CVE-2026-39360?
Medium severity, with a CVSS score of 4.3, published 7 April 2026.
Which products and versions are affected?
rustfs (crates.io) <= 0.0.2, SEMVER:introduced=0,last_affected=0.0.2.
Is there a fix for CVE-2026-39360?
A patch was published on 2026-04-07: Fixed in version alpha.90 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39360 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-39360?
Check whether you run rustfs (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check exists in the RustFS 'UploadPartCopy' multipart upload path. While standard 'CopyObject' operations correctly enforce source 'GetObject' and destination 'PutObject' permissions, the 'upload_part_copy', 'complete_multipart_upload', and 'abort_multipart_upload' functions in 'rustfs/src/storage/access.rs' fail open by returning 'Ok(())' without validating the requester's rights. An authenticated attacker can exploit this by initiating a multipart upload in a bucket they control and using the vulnerable 'UploadPartCopy' command to pull data from a victim's bucket into their own. This vulnerability breaks tenant isolation in multi-tenant deployments and is fixed in version alpha.90.

Affected products

  • rustfs RustFS < alpha.90

Identifiers

  • CVE-2026-39360
  • GHSA-mx42-j6wv-px98

Timeline

  • 2026-04-07: disclosed
  • 2026-04-07: advisory
  • 2026-04-07: patched: Fixed in version alpha.90

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.