CVE-2026-73288
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.1
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.24%
- CWE
- CWE-693, CWE-754
- Published
- 2026-08-12
- Last modified
- 2026-08-12
Affected products
- rustfs rustfs
Weakness type
Related vulnerabilities
- CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-79638 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87808 — SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
- CVE-2026-78552 — Validation Bypass in Okta Access Gateway Custom Directives
- CVE-2026-81376 — Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-77892 — Windows Boot Manager Elevation of Privilege Vulnerability
- CVE-2026-84811 — agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
- CVE-2026-84810 — claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan