CVE-2026-27607 - Vulnerability Analysis

Overview

RustFS 1.0.0-alpha.56 through 1.0.0-alpha.82 contains a broken access control vulnerability caused by lack of validation of policy conditions in presigned POST uploads, letting attackers bypass content-length, key, and content-type constraints to upload unauthorized files.

Severity & Score

Impact

Attackers can upload unauthorized files exceeding size limits or to arbitrary keys, leading to storage exhaustion and unauthorized data access.

Mitigation

Upgrade to version 1.0.0-alpha.83 or later.

References

• https://github.com/rustfs/rustfs/security/advisories/GHSA-w5fh-f8xh-5x3p

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2026-27607 - High (8.1) RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, s... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27607/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(1 repo)

• https://github.com/nikeee/CVE-2026-27607

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner