CVE-2026-55189: RustFS FTP Authorization Bypass—Read Access Without Permission

Technical summary

The FTP read (RETR) and probe (SIZE, MDTST, CWD) handlers in RustFS bypass IAM authorization checks by dispatching directly to the storage backend, unlike FTP write/list handlers and the entire HTTP S3 code path, which properly invoke IAM authorization functions. An authenticated attacker can enumerate and retrieve any object regardless of their IAM policy, including when their policy explicitly denies s3:GetObject. The vulnerability stems from missing authorization calls in specific FTP command handlers (CWE-862: Missing Authorization; CWE-863: Incorrect Authorization).

Business impact

Organizations deploying RustFS with FTP frontend enabled face confidentiality exposure: authenticated users can access sensitive data they should not read, and can probe bucket structures to enumerate storage assets. This bypasses intended access control boundaries and may violate compliance requirements (SOC 2, HIPAA, PCI-DSS) that depend on proper authorization enforcement. The risk is elevated in multi-tenant or regulated environments where strict data segregation is critical.

Affected systems

RustFS versions 1.0.0-alpha.1 through 1.0.0-beta.8 with FTP frontend enabled are vulnerable. The HTTP S3 API path is not affected. Deployments using only the HTTP interface, or RustFS 1.0.0-beta.9 and later, are not vulnerable. Check your deployment architecture to confirm whether FTP is active.

Exploitability

Exploitability is moderate to high. An attacker needs valid FTP credentials (low barrier in many organizations), network access to the FTP listener, and basic FTP client knowledge. No special tools, authentication bypass, or complex multi-step attacks are required. The CVSS 3.1 score of 7.7 (HIGH) reflects the low attack complexity, requirement for authentication (reducing opportunistic abuse), and high confidentiality impact across security boundaries (scope change).

Remediation

Upgrade to RustFS 1.0.0-beta.9 or later. If immediate patching is not possible, disable the FTP frontend and rely on the HTTP S3 API, which correctly enforces IAM policies. Verify that your IAM policies are correctly configured and test access controls after patching.

Patch guidance

Apply the patch by upgrading RustFS to version 1.0.0-beta.9 or later. Consult the official RustFS release notes and advisory for version-specific migration steps. Verify in your release/deployment pipeline that the patched version is deployed to all running instances. After upgrade, re-test IAM policy enforcement using your existing access control validation procedures.

Detection guidance

Monitor FTP access logs for unusual read patterns (RETR commands) or bucket probing activity (CWD to multiple buckets by a single user). Audit IAM policies and compare them to actual FTP access logs; users with explicit Deny on s3:GetObject should not appear in read transaction logs. If available, enable additional audit logging on the FTP frontend to capture command sequences. Inspect RustFS version in production to identify vulnerable deployments.

Why prioritize this

This vulnerability should be prioritized because it directly violates the principle of least privilege in multi-tenant or regulated storage environments, affects authenticated users (common attack surface), and requires only network and credential access. The HIGH CVSS score, confirmed confidentiality impact, and the ease of exploitation once credentials are obtained warrant rapid remediation. Organizations using FTP should patch within 1–2 weeks; those using only HTTP S3 should still update to close the door on future FTP enablement without re-review.

Risk score, explained

CVSS 3.1 score of 7.7 reflects: Network access (AV:N), low attack complexity (AC:L), requirement for valid credentials (PR:L), scope change (S:C, user actions affect confidentiality of other users' data), high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N). The scope change is critical: an authenticated user operating within the FTP protocol can access data outside their intended authorization boundary, affecting other users or tenants.

Frequently asked questions