# CVE-2026-55838: RustFS missing authorization in metrics endpoint

Source: https://junglewise.ai/threats/cve-2026-55838-rustfs-missing-authorization-in-metrics-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-55838 · Severity: medium · CVSS 4.3 · Published 2026-06-26

RustFS, a distributed storage system used for managing large-scale data, contains a security flaw where internal server performance data is visible to unauthorized users. Any user with basic login credentials can view sensitive operational details like disk usage, network traffic, and server health, even if their account is restricted to a specific folder. This information could allow an attacker to map out the company's storage infrastructure and identify patterns of activity or potential weaknesses.

## Quick answers

**Is CVE-2026-55838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55838 being exploited in the wild.

**How severe is CVE-2026-55838?** Medium severity, with a CVSS score of 4.3, published 26 June 2026.

**Which products and versions are affected?** rustfs RustFS <= 1.0.0-beta.7.

**Is there a fix for CVE-2026-55838?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55838 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55838?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check (CWE-862) exists in the MetricsHandler component of RustFS. While other administrative endpoints correctly invoke 'validate_admin_request' to enforce IAM policies, the metrics endpoint at '/rustfs/admin/v3/metrics' only verifies that credentials are present without checking if the user has administrative privileges. An authenticated attacker with low privileges (e.g., a restricted IAM user) can access server-wide operational metrics, including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state. This vulnerability was identified in version 1.0.0-beta.7 and earlier; no official patch version was specified in the advisory, though the issue is confirmed in the source code.

## Affected products

- rustfs RustFS <= 1.0.0-beta.7

## Timeline

- 2026-06-25: advisory: GitHub Security Advisory GHSA-f5cv-v44x-2xgf published
- 2026-06-26: disclosed: CVE-2026-55838 published to NVD

## References

- [https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf](https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf)