# CVE-2026-40937: RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks

Source: https://junglewise.ai/threats/cve-2026-40937-rustfs-missing-admin-authorization-on-notification-target  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40937 · Severity: high · CVSS 8.3 · Published 2026-04-22

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.

Technologies: [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-40937 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40937 being exploited in the wild.

**How severe is CVE-2026-40937?** High severity, with a CVSS score of 8.3, published 22 April 2026.

**Which products and versions are affected?** rustfs (crates.io) <= 0.0.2, SEMVER:introduced=0,last_affected=0.0.2.

**Is there a fix for CVE-2026-40937?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-40937?** Check whether you run rustfs (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- rustfs (crates.io) <= 0.0.2, SEMVER:introduced=0,last_affected=0.0.2

## Identifiers

- CVE-2026-40937
- GHSA-pfcq-4gjr-6gjm

## References

- [https://api.github.com/users/kodareef5](https://api.github.com/users/kodareef5)
- [https://github.com/kodareef5](https://github.com/kodareef5)
- [https://api.github.com/users/kodareef5/gists%7B/gist_id%7D](https://api.github.com/users/kodareef5/gists%7B/gist_id%7D)
- [https://api.github.com/users/kodareef5/repos](https://api.github.com/users/kodareef5/repos)
- [https://avatars.githubusercontent.com/u/261977334?v=4](https://avatars.githubusercontent.com/u/261977334?v=4)
- [https://api.github.com/users/kodareef5/events%7B/privacy%7D](https://api.github.com/users/kodareef5/events%7B/privacy%7D)

## Related threats

- [RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service…](https://junglewise.ai/threats/rustfs-listserviceaccount-authorizes-against-wrong-admin-action-fb9b6d2d)
- [RustFS missing authorization in multipart UploadPartCopy](https://junglewise.ai/threats/cve-2026-39360-rustfs-missing-authorization-in-multipart-uploadpartcopy)
- [Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover](https://junglewise.ai/threats/cve-2026-27822-rust-has-critical-stored-xss-in-preview-modal-leading-to)
- [RustFS: Missing Post Policy Validation leads to Arbitrary Object Write](https://junglewise.ai/threats/cve-2026-27607-rustfs-missing-post-policy-validation-leads-to-arbitrary-object)
- [RustFS Logs Sensitive Credentials in Plaintext](https://junglewise.ai/threats/cve-2026-24762-rustfs-logs-sensitive-credentials-in-plaintext)