CVE-2026-55189

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.1 through 1.0.0-beta.8

Description When the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without calling the IAM authorization function used by the FTP write/list handlers and the HTTP S3 path. This allows any authenticated user to read objects via the RETR command, obtain object status via SIZE and MDTM commands, and probe buckets using the CWD command, bypassing all IAM policies, including explicit deny rules for s3:GetObject.

Recommendations Update to version 1.0.0-beta.9. As a temporary mitigation, disable the FTP frontend to prevent unauthorized access to objects and buckets.