CVE-2026-21862

Name of the Vulnerable Software and Affected Versions RustFS versions prior to alpha.78

Description RustFS, a distributed object storage system, had a flaw in its access control mechanism. Specifically, the get condition values function improperly trusted the X-Forwarded-For and X-Real-Ip headers provided by clients without verifying a trusted proxy. This allowed any reachable client to spoof the aws:SourceIp and bypass IP-allowlist policies.

Recommendations Update to version alpha.78 or later.