CVE-2026-55838

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validate_admin_request to enforce admin-action IAM checks; the MetricsHandler skips this call entirely. A restricted IAM user whose policy grants only access to their own bucket can read server-wide operational metrics including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state.

• CWE-862

• https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf
• https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf

Published

Jun 26, 2026

Last Modified

Jun 27, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55825Contao is an Open Source CMS. In versions 5.7.0 through 5.7.…3.1
• CVE-2026-55827FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2026-5583A security vulnerability has been detected in PHPGurukul Onl…6.3
• CVE-2026-55830RestrictedPython is a tool that helps to define a subset of …8.3
• CVE-2026-55831Netty is a network application framework for development of …7.5
• CVE-2026-55833Netty is a network application framework for development of …7.5
• CVE-2026-5584A vulnerability has been found in Fosowl agenticSeek 0.1.0. …9.8
• CVE-2026-55843Snipe-IT is an IT asset/license management system. Prior to …6.5
• CVE-2026-55844Home Assistant is open source home automation software that …7.5
• CVE-2026-55849@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of …8.5
• CVE-2026-5585A vulnerability was found in Tencent AI-Infra-Guard 4.0. The…7.5
• CVE-2026-55851Netty is a network application framework for development of …7.5