CVE-2026-73284

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.11

Description RustFS is a distributed object storage system built in Rust. The AddServiceAccount handler in rustfs/src/admin/handlers/service account.rs allows an attacker to control the target user variable. The system only verifies the CreateServiceAccountAdminAction before passing the variable to the new service account() function. Subsequently, the prepare service account auth() function sets the is owner attribute for the resulting root-parent service account, potentially allowing unauthorized privilege escalation.

Recommendations Update to version 1.0.0-beta.11.