CVE-2026-73290

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.12

Description An issue exists where anonymous ListObjectVersions requests in rustfs/src/storage/access.rs that lack a direct bucket-policy grant fall back to an s3:ListBucket check. This process returns before the policy allowed path can apply deny anonymous table data plane if needed and RestrictPublicBuckets. Consequently, buckets that permit anonymous listing may continue to expose version listings even after public-access control is enabled. This bypass affects the 'GET /?versions=' endpoint and can disclose object version metadata, even when equivalent GetObject requests are denied.

Recommendations Update to version 1.0.0-beta.12.