Is CVE-2026-55188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55188 being exploited in the wild.

How severe is CVE-2026-55188?

High severity, with a CVSS score of 8.2, published 26 June 2026.

Which products and versions are affected?

rustfs RustFS 1.0.0-alpha.1 to 1.0.0-beta.8.

Is there a fix for CVE-2026-55188?

A patch was published on 2026-06-26: Fix confirmed in version 1.0.0-beta.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55188 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55188?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55188: RustFS authorization bypass in ListRemoteTargetHandler replication API

CVE-2026-55188 · Severity: high · CVSS 8.2 · Published 2026-06-26

RustFS, a distributed storage system, contains a security flaw in its administrative interface for managing data replication. An authenticated user without administrative privileges can access sensitive configuration details, including the secret access keys used to connect to remote storage targets. This could allow an unauthorized user to gain full access to data stored on remote backup or replication servers, potentially leading to a significant data breach.

Quick answers

Is CVE-2026-55188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55188 being exploited in the wild.
How severe is CVE-2026-55188?: High severity, with a CVSS score of 8.2, published 26 June 2026.
Which products and versions are affected?: rustfs RustFS 1.0.0-alpha.1 to 1.0.0-beta.8.
Is there a fix for CVE-2026-55188?: A patch was published on 2026-06-26: Fix confirmed in version 1.0.0-beta.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55188 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55188?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the ListRemoteTargetHandler within the RustFS bucket replication admin API. The handler, located at /rustfs/admin/v3/list-remote-targets, verifies that a request contains valid credentials but fails to perform a secondary authorization check to ensure the caller possesses replication or administrator permissions. An attacker with any valid account can invoke this endpoint to retrieve BucketTarget objects. These objects contain sensitive fields including accessKey, secretKey, and sessionToken for remote replication targets. The vulnerability was introduced in commit 3c7b66e and is resolved in version 1.0.0-beta.9.

Affected products

rustfs RustFS 1.0.0-alpha.1 to 1.0.0-beta.8

Timeline

2026-06-11: advisory: GitHub Security Advisory published
2026-06-26: disclosed: NVD publication date
2026-06-26: patched: Fix confirmed in version 1.0.0-beta.9

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-796f-j7xp-hwf4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.