CVE-2026-22042

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API validates permissions using `ExportIAMAction` instead of `ImportIAMAction`, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation. Version 1.0.0-alpha.79 fixes the issue.

• CWE-285
• CWE-863
• CWE-863

• https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64ccExploit, Vendor Advisory
• https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64ccExploit, Vendor Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22036Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 an…7.5
• CVE-2026-22037The @fastify/express plugin adds full Express compatibility …8.4
• CVE-2026-22038AutoGPT is a platform that allows users to create, deploy, a…8.1
• CVE-2026-22039Kyverno is a policy engine designed for cloud native platfor…9.9
• CVE-2026-22040NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …5.3
• CVE-2026-22041Logging Redactor is a Python library designed to redact sens…5.3
• CVE-2026-22043RustFS is a distributed object storage system built in Rust.…9.8
• CVE-2026-22044GLPI is a free asset and IT management software package. Fro…8.8
• CVE-2026-22045Traefik is an HTTP reverse proxy and load balancer. Prior to…7.5
• CVE-2026-22046iccDEV provides a set of libraries and tools that allow for …8.8
• CVE-2026-22047iccDEV provides a set of libraries and tools that allow for …8.8
• CVE-2026-22048StorageGRID (formerly StorageGRID Webscale) versions prior t…7.1