CVE-2026-27607: RustFS missing presigned POST policy validation enabling arbitrary object write

Overview

RustFS is a distributed object storage system written in Rust. According to the GitHub advisory, presigned POST uploads (PostObject) do not check the policy conditions attached to the upload, so the limits the policy is meant to enforce may not apply. The weakness is mapped to CWE-863 (Incorrect Authorization). Primary source: GitHub Security Advisory GHSA-w5fh-f8xh-5x3p.

Impact

The description in the record indicates that the following constraints can be bypassed:

• The content-length-range condition, allowing uploads larger than intended.
• The starts-with condition, allowing writes to object keys outside the intended scope.
• The Content-Type condition, allowing content-type spoofing.

The record links these bypasses to possible storage exhaustion, unauthorized data access and other security bypasses. NVD scores the CVE 9.1 (CVSS 3.1, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), with high integrity and availability impact and no confidentiality impact. A GitHub-provided score of 8.1 is also listed.

Affected products and versions

The record identifies the product as Rustfs Rustfs. The affected range is from 1.0.0-alpha.56 up to and including 1.0.0-alpha.82. The description states that 1.0.0-alpha.83 fixes the issue. The record lists many individual builds inside that range; confirm exact build coverage in the vendor advisory before making deployment decisions.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. SSVC data in the record reports exploitation as none and automatable as no. The EPSS probability is 0.00454 with a percentile of 0.38461, which are estimates and not evidence of exploitation.

Remediation and mitigation

• Upgrade RustFS to 1.0.0-alpha.83 or a later release, as stated in the description.
• The record contains no fixed-version list and no vendor-documented workaround, so workaround status is unknown.
• Until patched, consider limiting which principals can generate presigned POST policies and reviewing existing policies for overly broad conditions. This is an inference from the flaw description, not a vendor recommendation.

Detection guidance

• Review server logs for POST uploads to buckets, focusing on objects that are unusually large, written to unexpected key prefixes, or carrying unexpected content types.
• Compare object inventories and storage growth against expected baselines to spot unauthorized writes.
• Correlate upload events with the identities and policies used to generate the presigned requests.

Limitations of the available information

The record provides a short description and one vendor advisory reference. It does not include detailed technical analysis, default configuration details, the exact validation logic that was missing, or a list of confirmed fixed builds beyond the statement in the description. The fixes field is empty in the record. Whether exploitation requires any authentication or specific deployment settings is unknown from the sources consulted.

Frequently asked questions

What is the core flaw in CVE-2026-27607?

RustFS does not validate policy conditions on presigned POST uploads, so constraints such as size limits, key prefixes and Content-Type may not be enforced.

Which versions are affected?

According to the record, the affected range runs from 1.0.0-alpha.56 up to and including 1.0.0-alpha.82.

Is there a fix?

The description states that version 1.0.0-alpha.83 fixes the issue. The record does not list a separate fixed-version field.

Is this CVE known to be actively exploited?

It is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.