CVE-2026-55838

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validate_admin_request to enforce admin-action IAM checks; the MetricsHandler skips this call entirely. A restricted IAM user whose policy grants only access to their own bucket can read server-wide operational metrics including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state.

• CWE-862

• https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf
• https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf

Published

Jun 26, 2026

Last Modified

Jun 27, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55830RestrictedPython is a tool that helps to define a subset of …8.3
• CVE-2026-55831Netty is a network application framework for development of …7.5
• CVE-2026-55832Tract is a tiny, no-nonsense, self-contained TensorFlow and …6.1
• CVE-2026-55833Netty is a network application framework for development of …7.5
• CVE-2026-55834Pocket ID is an OIDC provider that allows users to authentic…4.3
• CVE-2026-55837dbt-mcp is a Model Context Protocol server for interacting w…6.8
• CVE-2026-55839Kestra is an open-source, event-driven orchestration platfor…8.7
• CVE-2026-5584A vulnerability has been found in Fosowl agenticSeek 0.1.0. …9.8
• CVE-2026-55841Graylog is a free and open log management platform. Prior to…7.5
• CVE-2026-55843Snipe-IT is an IT asset/license management system. Prior to …6.5
• CVE-2026-55844Home Assistant is open source home automation software that …7.5
• CVE-2026-55846Allure 2 is the version 2.x branch of Allure Report, a multi…6.2