7.5

CVE-2026-21862

RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rustfs ≫ Rustfs Version 1.0.0 Update alpha1 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha10 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha11 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha12 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha13 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha14 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha15 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha16 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha17 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha18 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha19 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha2 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha20 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha21 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha22 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha23 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha24 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha25 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha26 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha27 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha28 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha29 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha3 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha30 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha31 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha32 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha33 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha34 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha35 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha36 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha37 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha38 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha39 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha4 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha40 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha41 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha42 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha43 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha44 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha45 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha46 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha47 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha48 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha49 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha5 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha50 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha51 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha52 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha53 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha54 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha55 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha56 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha57 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha58 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha59 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha6 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha60 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha61 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha62 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha63 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha64 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha65 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha66 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha67 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha68 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha69 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha7 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha70 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha71 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha72 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha73 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha74 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha75 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha76 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha77 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha8 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha9 SwPlatform rust
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.113
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
security-advisories@github.com 7.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-290 Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

https://github.com/rustfs/rustfs/security/advisories/GHSA-fc6g-2gcp-2qrq
Vendor Advisory