Is CVE-2026-55838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55838 being exploited in the wild.

How severe is CVE-2026-55838?

Medium severity, with a CVSS score of 4.3, published 26 June 2026.

Is there a fix for CVE-2026-55838?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-55838 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55838?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55838: RustFS missing authorization in metrics endpoint

CVE-2026-55838 · Severity: medium · CVSS 4.3 · Published 2026-06-26

RustFS, a distributed storage system used for managing large-scale data, contains a security flaw where internal server performance data is visible to unauthorized users. Any user with basic login credentials can view sensitive operational details like disk usage, network traffic, and server health, even if their account is restricted to a specific folder. This information could allow an attacker to map out the company's storage infrastructure and identify patterns of activity or potential weaknesses.

Quick answers

Is CVE-2026-55838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55838 being exploited in the wild.
How severe is CVE-2026-55838?: Medium severity, with a CVSS score of 4.3, published 26 June 2026.
Which products and versions are affected?: rustfs RustFS <= 1.0.0-beta.7.
Is there a fix for CVE-2026-55838?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-55838 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55838?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) exists in the MetricsHandler component of RustFS. While other administrative endpoints correctly invoke 'validate_admin_request' to enforce IAM policies, the metrics endpoint at '/rustfs/admin/v3/metrics' only verifies that credentials are present without checking if the user has administrative privileges. An authenticated attacker with low privileges (e.g., a restricted IAM user) can access server-wide operational metrics, including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state. This vulnerability was identified in version 1.0.0-beta.7 and earlier; no official patch version was specified in the advisory, though the issue is confirmed in the source code.

Affected products

rustfs RustFS <= 1.0.0-beta.7

Timeline

2026-06-25: advisory: GitHub Security Advisory GHSA-f5cv-v44x-2xgf published
2026-06-26: disclosed: CVE-2026-55838 published to NVD

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.