CVE-2026-45042: RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source

Synopsis

An improper authorization flaw in RustFS, a distributed object storage system built in Rust, allows an authenticated user to copy objects between buckets without the destination bucket's copy-source policy being enforced. The flaw is reachable over the network with low-privilege credentials and no victim interaction. Successful exploitation lets an attacker read and move object data from source buckets into buckets that should not permit that copy source, bypassing tenant isolation controls. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the RustFS API over the network; the service is exposed via standard HTTP/S object-storage endpoints.

• AuthenticationRequired

  A low-privilege account with GetObject on a source bucket and PutObject on a destination bucket is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker operates entirely through API calls and does not need any other user to take action.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• An attacker reads object data stored in source buckets that the destination bucket's policy was meant to restrict access to.
• Cross-bucket copy operations succeed silently, bypassing tenant or namespace isolation enforced through destination bucket policy rules.
• Sensitive objects such as credentials, backups, or customer records can be moved into attacker-accessible buckets without triggering policy-based controls.