CVE-2026-39360: RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration

April 8, 2026 (updated April 10, 2026)

RustFS contains a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can still exfiltrate victim objects by copying them into an attacker-controlled multipart upload and completing the upload.

This breaks tenant isolation in multi-user / multi-tenant deployments.

References

github.com/advisories/GHSA-mx42-j6wv-px98
github.com/rustfs/rustfs
github.com/rustfs/rustfs/security/advisories/GHSA-mx42-j6wv-px98
nvd.nist.gov/vuln/detail/CVE-2026-39360

Code Behaviors & Features

Detect and mitigate CVE-2026-39360 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →