Is CVE-2026-45042 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45042 being exploited in the wild.

How severe is CVE-2026-45042?

Informational severity, with a CVSS score of 7.1, published 28 May 2026.

Is there a fix for CVE-2026-45042?

A patch was published on 2026-05-28: Fixed in version 1.0.0-beta.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45042 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-45042?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45042: RustFS improper authorization in UploadPartCopy operation

CVE-2026-45042 · Severity: info · CVSS 7.1 · Published 2026-05-28

RustFS is a distributed storage system used to manage large amounts of data in 'buckets.' A security flaw in the file-copying feature allows users with basic access to move data between buckets even when security policies should prevent it. This could allow an attacker to bypass data isolation rules and copy sensitive information into a location they fully control, leading to unauthorized data exposure.

Quick answers

Is CVE-2026-45042 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45042 being exploited in the wild.
How severe is CVE-2026-45042?: Informational severity, with a CVSS score of 7.1, published 28 May 2026.
Which products and versions are affected?: rustfs RustFS < 1.0.0-beta.2.
Is there a fix for CVE-2026-45042?: A patch was published on 2026-05-28: Fixed in version 1.0.0-beta.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45042 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-45042?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the `UploadPartCopy` operation of RustFS due to insufficient validation of cross-bucket policy constraints. While the system independently verifies `GetObject` permissions for the source and `PutObject` permissions for the destination, it fails to enforce bucket-level isolation policies that restrict which sources a destination bucket may accept data from. An attacker with low-privileged network access (valid credentials for both a source and destination bucket) can exploit this to move sensitive data into an attacker-controlled bucket, bypassing tenant isolation. The issue is rooted in `rustfs/src/storage/access.rs` where source and destination checks are decoupled. This vulnerability is resolved in version 1.0.0-beta.2.

Affected products

rustfs RustFS < 1.0.0-beta.2

Timeline

2026-05-09: advisory: GitHub advisory published
2026-05-28: disclosed: NVD publication date
2026-05-28: patched: Fixed in version 1.0.0-beta.2

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-wfxj-ph3v-7mjf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.