High severityNVD Advisory· Published Feb 3, 2026· Updated Feb 3, 2026
RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers
CVE-2026-21862
Description
RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
rustfscrates.io | < 1.0.0-alpha.78 | 1.0.0-alpha.78 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-fc6g-2gcp-2qrqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-21862ghsaADVISORY
- github.com/rustfs/rustfs/commit/b4ba62fa3300b5b258fdc0da141481e3be7ea960ghsaWEB
- github.com/rustfs/rustfs/security/advisories/GHSA-fc6g-2gcp-2qrqghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.