CVE-2026-49991

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.

• CWE-22
• CWE-862

• https://github.com/rustfs/rustfs/security/advisories/GHSA-f4vq-9ffr-m8m3
• https://github.com/rustfs/rustfs/security/advisories/GHSA-f4vq-9ffr-m8m3

Published

Jun 26, 2026

Last Modified

Jun 29, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49984Kestra is an open-source, event-driven orchestration platfor…7.7
• CVE-2026-49986The Cortex MCP server (`neuro-cortex-memory`), a cross-platf…7.1
• CVE-2026-49987Repomix is a tool that packs repositories into AI-friendly f…8.8
• CVE-2026-49988Repomix is a tool that packs repositories into AI-friendly f…5.5
• CVE-2026-49989CrateDB is a distributed SQL database. Prior to versions 6.2…7.1
• CVE-2026-4999A security vulnerability has been detected in z-9527 admin u…6.3
• CVE-2026-49992Kimai is an open-source time tracking application. Versions …6.3
• CVE-2026-49993Nuxt is an open-source web development framework for Vue.js.…5.7
• CVE-2026-49995Tautulli is a Python based monitoring and tracking tool for …4.8
• CVE-2026-49996SecureDrop Client is a desktop app for journalists to secure…3.7
• CVE-2026-49997SurrealDB is a scalable, distributed, collaborative, documen…5.4
• CVE-2026-49998Centrifugo is an open-source scalable real-time messaging se…8.2