{"id":"CVE-2026-22042","aliases":["GHSA-vcwh-pff9-64cc"],"url":"https://o3.security/vulnerability/CVE-2026-22042","summary":"RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation","details":"### Summary\n\nThe `ImportIam` admin API validates permissions using **`ExportIAMAction`** instead of **`ImportIAMAction`**, allowing a principal with *export-only* IAM permissions to perform *import* operations. Since importing IAM data performs privileged **write** actions (creating/updating users, groups, policies, and service accounts), this can lead to **unauthorized IAM modification and privilege escalation**.\n\n---\n\n### Details\n\nIn `ImportIam`, the authorization check is implemented as follows:\n\n```rust\nvalidate_admin_request(\n    &req.headers,\n    &cred,\n    owner,\n    false,\n    vec![Action::AdminAction(AdminAction::ExportIAMAction)],\n).await?;\n```\n\nHowever, this code resides in the **Import IAM** operation (`struct ImportIam {}`), which performs **state-changing IAM writes**.\n\nThe expected behavior is to validate against **`AdminAction::ImportIAMAction`** (or an equivalent import-specific admin action), not `ExportIAMAction`.\n\n---\n\n### PoC\n\n**Prerequisites**\n\n1. A RustFS deployment with IAM enabled.\n2. An IAM user or role that has **Export IAM** permission but **does not** have Import IAM or full admin permissions.\n3. Access credentials for that user.\n\n**Steps**\n\n1. Create or obtain an IAM principal with permission equivalent to:\n\n   ```\n   AdminAction::ExportIAMAction\n   ```\n\n   and without Import IAM privileges.\n\n2. Prepare a valid IAM import ZIP archive containing, for example:\n\n   * A new policy granting administrative permissions\n   * A user or service account bound to that policy\n\n3. Send a request to the Import IAM endpoint (the same endpoint handled by `ImportIam::call`), authenticating with the export-only credentials.\n\n4. Observe that:\n\n   * The request passes authorization.\n   * IAM entities from the archive are created or modified successfully.\n\n**Expected Result**\n\n* The request should be rejected with an authorization error (e.g., AccessDenied).\n\n**Actual Result**\n\n* The request succeeds, and IAM state is modified.","published":"2026-01-08T14:58:10.785Z","modified":"2026-08-12T03:51:22.749895156Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"rustfs","fixedVersion":"1.0.0-alpha.79"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22042.json"},{"type":"ADVISORY","url":"https://github.com/rustfs/rustfs/security/advisories/GHSA-vcwh-pff9-64cc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22042"},{"type":"PACKAGE","url":"https://github.com/rustfs/rustfs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:22.749895156Z"}}