CVE-2026-73289

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.12

Description RustFS incorrectly evaluates the ForAllValues: and ForAnyValue: set qualifiers when used with negated string operators: StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike. This occurs because the system negates the aggregate result after the eval() or eval like() functions instead of negating each request-value predicate before quantification. Consequently, partially overlapping policy and request value sets can cause an Allow condition to grant access to an excluded principal or cause a Deny guardrail to fail, specifically affecting policies based on jwt:groups and jwt:roles. Additionally, absent keys exhibit the opposite behavior for ForAllValues: and ForAnyValue:.

Recommendations Update to version 1.0.0-beta.12.