CVE-2026-49991

Name of the Vulnerable Software and Affected Versions RustFS version 1.0.0-beta.4

Description Authenticated users with PutObject permission on their own bucket can exploit a path traversal issue in the Snowball auto-extract feature to write arbitrary objects into buckets belonging to other users, which compromises multi-tenant isolation. This occurs due to a chain of three flaws: a lack of ../ sanitization during tar entry key normalization, the use of raw, uncleaned paths in IAM wildcard matching, and filesystem path cleaning that resolves ../ sequences across bucket boundaries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.