CVE-2026-73285

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.64 through 1.0.0-rc.1

Description An issue exists in the external OPA (Open Policy Agent) authorization, which is enabled by the RUSTFS POLICY PLUGIN URL variable in crates/iam/src/sys.rs. The system incorrectly sets PreparedIamAuth.needs existing object tag for PreparedIamMode::Opa, which causes the maybe merge object tag conditions() function to omit s3:ExistingObjectTag/* values. This allows authenticated users to bypass policy restrictions based on object tags.

Recommendations Update to version 1.0.0-rc.1.