Executive brief
RustFS, a distributed storage system used for managing large-scale data, contains a security flaw where internal server performance data is visible to unauthorized users. Any user with basic login credentials can view sensitive operational details like disk usage, network traffic, and server health, even if their account is restricted to a specific folder. This information could allow an attacker to map out the company's storage infrastructure and identify patterns of activity or potential weaknesses.
Technical details
A missing authorization check (CWE-862) exists in the MetricsHandler component of RustFS. While other administrative endpoints correctly invoke 'validate_admin_request' to enforce IAM policies, the metrics endpoint at '/rustfs/admin/v3/metrics' only verifies that credentials are present without checking if the user has administrative privileges. An authenticated attacker with low privileges (e.g., a restricted IAM user) can access server-wide operational metrics, including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state. This vulnerability was identified in version 1.0.0-beta.7 and earlier; no official patch version was specified in the advisory, though the issue is confirmed in the source code.
Affected products
- rustfs RustFS <= 1.0.0-beta.7
Timeline
- 2026-06-25: advisory: GitHub Security Advisory GHSA-f5cv-v44x-2xgf published
- 2026-06-26: disclosed: CVE-2026-55838 published to NVD