GHSA-pfcq-4gjr-6gjm — rustfs
HIGHGHSA-pfcq-4gjr-6gjm is a high-severity (CVSS 8.3) CWE-862 vulnerability in rustfs. No vendor fix is recorded yet; mitigation options are listed below.
RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-pfcq-4gjr-6gjm.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-pfcq-4gjr-6gjm plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,166 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
rustfsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Missing Admin Auth on Notification Target Endpoints in RustFS
Finding Summary
All four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a check_permissions helper that validates authentication only (access key + session token), without performing any admin-action authorization via validate_admin_request. Every other admin handler in the codebase correctly calls validate_admin_request with a specific AdminAction. This is the only admin handler file that skips authorization.
A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion.
What Was Proven Live
-
Authorization bypass on all four endpoints (03_readonly_user_bypass.py)
- PUT, GET list, GET arns, DELETE all return 200 for readonly-user
- Control routes (list-users, kms/status) correctly return 403
- Unauthenticated requests correctly rejected (403 Signature required)
-
SSRF via health probe (04_ssrf_listener_landing.py)
- HEAD request from rustfs container to attacker-controlled listener
- No host validation: only scheme check (http/https)
-
Target hijacking and event exfiltration (05_target_hijacking.py, 06_full_event_exfil.py)
- Readonly-user overwrites admin-configured target URL by name
- Subsequent S3 events delivered to attacker-controlled endpoint
- Captured event body includes object keys, bucket names, user identities, and request metadata
-
Audit evasion (05_target_hijacking.py)
- Readonly-user can delete unbound targets
- Readonly-user can overwrite bound targets (silently redirecting events)
Escalation Vectors Tested But Not Viable
-
Self-referencing webhook to admin API (13_self_referencing_test.py)
- Webhook sends unsigned POST with event JSON body
- Admin endpoints require SigV4 auth -- unsigned request rejected
- "Confused deputy" via self-referencing does NOT work
-
Protocol smuggling via non-HTTP targets
- Only 2 target types implemented: webhook and MQTT (
event.rs:613enforces this) - No Redis, Kafka, AMQP, or other protocol targets exist
- CRLF injection in webhook config fields sanitized by reqwest
- MQTT uses rumqttc (pure Rust binary protocol client), no raw TCP injection
- Only 2 target types implemented: webhook and MQTT (
-
MQTT target for RCE
- No unsafe code in MQTT handler
- rumqttc 0.29.0 has no known public CVEs
- No Command::new, template engines, or deserialization of broker responses
-
Unauth access
- Endpoints correctly reject unauthenticated requests (403)
- Endpoints correctly reject invalid credentials (403)
Prior Art
No existing advisory covers notification target endpoints. 11 published GHSAs on rustfs/rustfs cover different handlers. Closest:
- CVE-2026-22042 (ImportIam wrong action constant) -- same bug class, different file
- CVE-2026-22043 (deny_only short-circuit) -- different bug class
Recommendation
Submit via GitHub PVR. The finding is well-supported with live PoC, code references, and clear root cause. The fix is straightforward (add validate_admin_request calls to event.rs handlers). Core submission should reference 2-3 focused PoC scripts (readonly bypass, target hijack, event exfil), not the full set of 13 exploratory scripts.
Koda Reef
Patch
This issue has been patched in version https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.94.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | rustfs | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for rustfs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of rustfs has shipped for GHSA-pfcq-4gjr-6gjm yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-pfcq-4gjr-6gjm can be triaged on real exposure rather than presence alone.
Tailored to GHSA-pfcq-4gjr-6gjm. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-pfcq-4gjr-6gjm in your dependencies?
O3 Security finds GHSA-pfcq-4gjr-6gjm across crates.io dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.