RustFS 1.0.0 Alpha 93 for Rust
Approved changes feed: RSS · Atom
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha93:*:*:*:rust:*:*
part: a version: 1.0.0 update: alpha93
| Vendor | Rustfs (742894ef-658d-5cdc-8784-77e6e7b0959e) |
|---|---|
| Product | Rustfs (4be71209-6ebc-5407-9635-d0b06dc1f232) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | rust |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/rustfs/rustfs |
purl2cpe | 2026-07-28 16:41:08.256120 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-40937 |
vulnerable | 2026-06-08 08:03:14.460130 |
RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks
HIGH (8.3)
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + session token), without performing any admin-action authorization via `validate_admin_request`. Every other admin handler in the codebase correctly calls `validate_admin_request` with a specific `AdminAction`. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.
Published: 2026-04-22T20:15:57.266Z
Updated: 2026-04-23T16:24:57.337Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.