# CVE-2026-55189: rustfs RustFS missing authorization in FTP frontend object reads

Source: https://junglewise.ai/threats/cve-2026-55189-rustfs-rustfs-missing-authorization-in-ftp-frontend-object-reads  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-55189 · Severity: high · CVSS 7.7 · Published 2026-06-26

RustFS is a storage system used to manage and store large amounts of data across multiple servers. A security flaw in its FTP interface allows any user with valid login credentials to bypass security policies and read any file in the system, even if they have been explicitly denied access. This could lead to the unauthorized exposure of sensitive customer data or proprietary company information if the FTP feature is enabled.

## Quick answers

**Is CVE-2026-55189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55189 being exploited in the wild.

**How severe is CVE-2026-55189?** High severity, with a CVSS score of 7.7, published 26 June 2026.

**Which products and versions are affected?** rustfs RustFS 1.0.0-alpha.1 to 1.0.0-beta.8.

**Is there a fix for CVE-2026-55189?** A patch was published on 2026-06-26: Fixed in version 1.0.0-beta.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55189 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55189?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability exists in the RustFS FTP frontend (specifically in `crates/protocols/src/ftps/driver.rs`). While the HTTP S3 API and certain FTP operations (write/list) correctly invoke the IAM authorization function, the FTP read (`RETR`) and probe (`SIZE`/`MDTM`/`CWD`) handlers dispatch directly to the storage backend. An attacker with valid IAM credentials can authenticate to the FTP listener and bypass all IAM policy restrictions, including explicit 'Deny' statements on `s3:GetObject`. This results in a complete break of read-confidentiality across all buckets in a multi-tenant environment. The issue is fixed in version 1.0.0-beta.9.

## Affected products

- rustfs RustFS 1.0.0-alpha.1 to 1.0.0-beta.8

## Timeline

- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: NVD publication date
- 2026-06-26: patched: Fixed in version 1.0.0-beta.9

## References

- [https://github.com/rustfs/rustfs/security/advisories/GHSA-3g29-xff2-92vp](https://github.com/rustfs/rustfs/security/advisories/GHSA-3g29-xff2-92vp)