CVE-2026-73288

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-rc.1

Description Object Lock enforcement in the crates/ecstore/src/bucket/object lock/objectlock sys.rs file incorrectly handles certain error conditions. Specifically, the functions check object lock for deletion(), delete prefix(), and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as if no lock configuration exists. This allows objects under COMPLIANCE retention—a strict Write Once Read Many (WORM) state that prevents deletion—to be deleted or expired.

Recommendations Update to version 1.0.0-rc.1.