VYPR
← All advisories
High severity8.3NVD Advisory· Published Apr 22, 2026· Updated Apr 24, 2026

CVE-2026-40937

CVE-2026-40937

Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a check_permissions helper that validates authentication only (access key + session token), without performing any admin-action authorization via validate_admin_request. Every other admin handler in the codebase correctly calls validate_admin_request with a specific AdminAction. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rustfscrates.io
<= 0.0.2—

Affected products

93
  • Rustfs/Rustfs93 versions
    cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*+ 92 more
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha83:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha84:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha85:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha86:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha87:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha88:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha89:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha90:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha91:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha92:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha93:*:*:*:rust:*:*
    • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.