Executive brief
RustFS is a storage system used to manage and store large amounts of data across multiple servers. A security flaw in its FTP interface allows any user with valid login credentials to bypass security policies and read any file in the system, even if they have been explicitly denied access. This could lead to the unauthorized exposure of sensitive customer data or proprietary company information if the FTP feature is enabled.
Technical details
A missing authorization vulnerability exists in the RustFS FTP frontend (specifically in `crates/protocols/src/ftps/driver.rs`). While the HTTP S3 API and certain FTP operations (write/list) correctly invoke the IAM authorization function, the FTP read (`RETR`) and probe (`SIZE`/`MDTM`/`CWD`) handlers dispatch directly to the storage backend. An attacker with valid IAM credentials can authenticate to the FTP listener and bypass all IAM policy restrictions, including explicit 'Deny' statements on `s3:GetObject`. This results in a complete break of read-confidentiality across all buckets in a multi-tenant environment. The issue is fixed in version 1.0.0-beta.9.
Affected products
- rustfs RustFS 1.0.0-alpha.1 to 1.0.0-beta.8
Timeline
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: NVD publication date
- 2026-06-26: patched: Fixed in version 1.0.0-beta.9