CVE-2026-55838: RustFS Metrics Endpoint IAM Authorization Bypass

Technical summary

CVE-2026-55838 involves improper access control in the MetricsHandler of RustFS 1.0.0-beta.7 and earlier. The vulnerability stems from the metrics endpoint handler failing to invoke validate_admin_request(), a standard IAM check applied throughout the rest of the admin handler codebase. This omission allows any principal with valid IAM credentials—regardless of policy scope—to access the /rustfs/admin/v3/metrics endpoint and retrieve cluster-wide operational telemetry including disk I/O counters, network throughput, scanner cycle timings, and RPC state information. The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 score of 4.3 (Medium), reflecting the confidentiality impact of exposing operational metrics without integrity or availability consequences.

Business impact

Exposure of cluster operational metrics can enable reconnaissance and performance analysis by users who should not have that visibility. In multi-tenant deployments, restricted users could infer the presence, scale, and operational patterns of other tenants' workloads by observing disk I/O, network throughput, and scanner activity. This information leakage may inform lateral movement or resource contention attacks and violates least-privilege access controls. For compliance-sensitive environments, unauthorized metric visibility may breach data residency or tenant isolation requirements. The impact is informational rather than catastrophic, but it undermines the integrity of access control boundaries.

Affected systems

RustFS versions 1.0.0-beta.7 and earlier are vulnerable. The distributed object storage system affects any deployment using affected versions where the metrics endpoint is accessible (typically on admin interfaces). Organizations running RustFS in production—especially multi-tenant or regulated environments—should inventory their deployments and verify current version numbers.

Exploitability

Exploitability is straightforward. The vulnerability requires only valid IAM credentials (low bar in authenticated systems) and network access to the metrics endpoint; no special techniques, race conditions, or bypass chains are needed. Once authenticated, the attack is unauthenticated-like in its simplicity: a direct HTTP GET request to /rustfs/admin/v3/metrics. However, real-world impact depends on endpoint exposure; if the admin interface is properly network-segmented, exposure is reduced. The CVSS score reflects this accessibility (network-based, low complexity, low privilege requirement) balanced against the limited scope of information disclosure.

Remediation

Upgrade RustFS to a patched version that includes the validate_admin_request() check in the MetricsHandler. Verify the fix against the official RustFS release notes or vendor advisory. As an interim control, restrict network access to the /rustfs/admin/v3/metrics endpoint using network ACLs or firewall rules, limiting access only to known admin clients or monitoring systems that legitimately require cluster metrics. Audit IAM policies to ensure no over-provisioned users have broad admin scope; apply least-privilege policy assignments.

Patch guidance

Apply the latest patched version of RustFS once available from the vendor. Before deploying, test in a staging environment to verify that legitimate admin and monitoring workflows still function correctly. Verify that the MetricsHandler now calls validate_admin_request() consistently with other admin handlers. Coordinate the patch rollout with your change management process, especially in production clusters, to minimize downtime.

Detection guidance

Monitor access logs for the /rustfs/admin/v3/metrics endpoint. Alert on repeated or unusual access patterns from non-admin IAM principals. Review IAM audit trails to identify which users successfully accessed the endpoint in past deployments; this will reveal who may have obtained metric visibility inappropriately. Check network flow logs if the admin interface is expected to receive traffic only from specific management hosts. Implement continuous compliance scanning to detect unpatched RustFS versions in your environment.

Why prioritize this

Although scored as Medium severity, this vulnerability should be prioritized based on your deployment model. In multi-tenant or regulated cloud environments, isolation violations are critical; patch sooner. In single-tenant or air-gapped deployments with strong network segmentation, priority is lower. The ease of exploitation (authenticated user + direct HTTP request) is offset by the low confidentiality impact (operational metrics, not user data). Apply quickly if you operate RustFS in a shared-tenancy model; defer slightly if the admin interface is already restricted and users are trusted.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects: (1) Network-accessible endpoint (AV:N), (2) no complex attack prerequisites (AC:L), (3) requires valid credentials but any authenticated user qualifies (PR:L), (4) no user interaction (UI:N), (5) unchanged scope—the impact is contained within the RustFS service (S:U), and (6) low confidentiality impact from metrics disclosure with no integrity or availability loss (C:L/I:N/A:N). The score appropriately downgrades severity because metrics are generally less sensitive than user data, but the authorization bypass itself is a meaningful control gap.

Frequently asked questions