CVE-2026-55838

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.8

Description RustFS is a distributed object storage system built in Rust. The real-time metrics endpoint '/rustfs/admin/v3/metrics' is accessible to any valid IAM user, regardless of their assigned policy. This occurs because the MetricsHandler fails to call the validate admin request() function, which is used by other admin handlers to enforce admin-action IAM checks. Consequently, a restricted IAM user can access server-wide operational metrics, including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state.

Recommendations Update to a version later than 1.0.0-beta.7. Restrict access to the '/rustfs/admin/v3/metrics' endpoint to minimize the risk of unauthorized information disclosure.