CVE-2026-22043: RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

January 8, 2026

A flawed deny_only short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions.

References

github.com/advisories/GHSA-xgr5-qc6w-vcg9
github.com/rustfs/rustfs
github.com/rustfs/rustfs/security/advisories/GHSA-xgr5-qc6w-vcg9
nvd.nist.gov/vuln/detail/CVE-2026-22043

Code Behaviors & Features

Detect and mitigate CVE-2026-22043 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →