CVE-2026-27607: RustFS: Missing Post Policy Validation leads to Arbitrary Object Write

February 25, 2026

RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses.

References

github.com/advisories/GHSA-w5fh-f8xh-5x3p
github.com/rustfs/rustfs
github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.83
github.com/rustfs/rustfs/security/advisories/GHSA-w5fh-f8xh-5x3p
nvd.nist.gov/vuln/detail/CVE-2026-27607

Code Behaviors & Features

Detect and mitigate CVE-2026-27607 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →