CVE-2026-46685

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and Access-Control-Allow-Headers: * on responses, including preflight responses and error responses. This creates a permissive cross-domain policy with untrusted origins. A browser visiting an attacker-controlled page can issue credentialed cross-origin requests to a reachable RustFS deployment and read the response when the victim browser has ambient credentials for the RustFS origin, such as saved HTTP Basic Auth credentials, reverse-proxy SSO cookies, or TLS client certificates. This vulnerability is fixed in 1.0.0-beta.2.

• CWE-306
• CWE-346
• CWE-942

• https://github.com/rustfs/rustfs/security/advisories/GHSA-x5xv-223c-8vm7
• https://github.com/rustfs/rustfs/security/advisories/GHSA-x5xv-223c-8vm7

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4668The Booking for Appointments and Events Calendar - Amelia pl…6.5
• CVE-2026-46680containerd is an open-source container runtime. In versions …7.8
• CVE-2026-46681@nevware21/ts-utils is a comprehensive TypeScript/JavaScript…7.2
• CVE-2026-46682BigBlueButton is an open-source virtual classroom. Prior to …8.5
• CVE-2026-46683Snappy is a PHP library allowing thumbnail, snapshot or PDF …6.9
• CVE-2026-46684DataEase is an open source data visualization and analysis t…9.5
• CVE-2026-46686Emlog is an open source website building system. In 2.6.13 a…8.5
• CVE-2026-46687Emlog is an open source website building system. In 2.6.13 a…7.7
• CVE-2026-46688The Meeting Room Booking System (MRBS) is a PHP-based applic…6.9
• CVE-2026-46689Kanidm is an identity management platform. Prior to version …8.7
• CVE-2026-46690unbounded_spsc is an "unbounded" extension of bounded_spsc_q…5.8
• CVE-2026-46692ImageMagick is free and open-source software used for editin…4.1