ZeroDay Findings
Sign inSign up

Findings

CVE-2026-40937

RustFS is a distributed object storage system built in Rust.

Published Apr 22, 2026 · updated Jun 17, 2026 · rustfs rustfs

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in use a helper that validates authentication only (access key + session token), without performing any admin-action authorization via . Every other admin handler in the codebase correctly calls with a specific . This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 22, 2026 · NIST NVD

    Detected

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in use a helper that validates authentication only (access key + session token), without performing any admin-action authorization via . Every other admin handler in the codebase correctly calls with a specific . This is the only admin handler file that skips autho

  2. Jun 17, 2026 · NIST NVD

    Updated

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in use a helper that validates authentication only (access key + session token), without performing any admin-action authorization via . Every other admin handler in the codebase correctly calls with a specific . This is the only admin handler file that skips autho

Affected

  • cpe rustfs/rustfs1.0.0

Sources

  • CVE.orgVulnerability recordCVE-2026-40937

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-40937

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in use a helper that validates authentication only (access key + session token), without

    nvd.nist.gov

References