CVE-2026-40937 PUBLISHED

RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks

Assigner: GitHub_M
Reserved: 15.04.2026 Published: 22.04.2026 Updated: 22.04.2026

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in rustfs/src/admin/handlers/event.rs use a check_permissions helper that validates authentication only (access key + session token), without performing any admin-action authorization via validate_admin_request. Every other admin handler in the codebase correctly calls validate_admin_request with a specific AdminAction. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS Score: 8.3

Product Status

Vendor rustfs
Product rustfs
Versions
  • Version < 1.0.0-alpha.94 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE