CVE-2026-22042: RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

January 8, 2026

The ImportIam admin API validates permissions using ExportIAMAction instead of ImportIAMAction, allowing a principal with export-only IAM permissions to perform import operations. Since importing IAM data performs privileged write actions (creating/updating users, groups, policies, and service accounts), this can lead to unauthorized IAM modification and privilege escalation.

References

github.com/advisories/GHSA-vcwh-pff9-64cc
github.com/rustfs/rustfs
github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc
nvd.nist.gov/vuln/detail/CVE-2026-22042

Code Behaviors & Features

Detect and mitigate CVE-2026-22042 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →