CVE-2026-27607
8.1RustFS · RustFS
RustFS fails to validate policy conditions in presigned POST uploads, allowing authenticated attackers to bypass constraints on file size, object keys, and content types.
Executive summary
A vulnerability in RustFS allows authenticated attackers to perform unauthorized file uploads and bypass security constraints, posing a significant risk to storage integrity and availability.
Vulnerability
This flaw involves improper input validation and incorrect authorization within the PostObject functionality. An authenticated attacker can bypass policy conditions, including content-length-range and content-type constraints, to upload arbitrary files or exceed storage quotas.
Business impact
The ability to bypass upload constraints can lead to severe operational consequences, including storage exhaustion and unauthorized data placement. By spoofing content types or uploading oversized files, an attacker can disrupt services and potentially gain unauthorized access to data, resulting in both system instability and potential regulatory compliance failures. Given the CVSS score of 8.1, this represents a high-severity risk that requires immediate attention to prevent malicious abuse of the storage infrastructure.
Remediation
Immediate Action: Update the RustFS package to version 1.0.0-alpha.83 or later to ensure proper policy validation is enforced.
Proactive Monitoring: Review access logs for unusual POST requests directed at the object storage API, specifically looking for abnormally large uploads or attempts to change file content types.
Compensating Controls: Implement strict network-level ingress filtering and web application firewall rules to limit the size and type of objects allowed during the upload process until patching is completed.
Exploitation status
Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (https://github.com/nikeee/CVE-2026-27607).
Analyst recommendation
The identified flaw in the RustFS PostObject mechanism presents a clear path for attackers to compromise storage integrity and availability. Because a public proof-of-concept is available, administrators should prioritize updating to version 1.0.0-alpha.83 immediately. Failure to address this vulnerability exposes the environment to significant risks, including service disruption and unauthorized data manipulation.