CVE-2026-21862: 
Rust vulnerability analysis and mitigation

CVE-2026-21862 is an IP-based access control bypass vulnerability in RustFS, a distributed object storage system built in Rust. The flaw allows any network-reachable client to spoof the aws:SourceIp condition by injecting arbitrary values into X-Forwarded-For or X-Real-Ip HTTP headers, thereby satisfying IP-allowlist policies without authorization. All versions prior to 1.0.0-alpha.78 are affected. It was disclosed on February 3, 2026, with a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 7.7 (High) (GitHub Advisory, RustFS Advisory).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing). In rustfs/src/auth.rs (lines 289–304), the get_condition_values function reads the client-supplied X-Forwarded-For or X-Real-Ip headers without validating that the request originates from a trusted proxy, then inserts the resulting value as SourceIp via get_source_ip_raw. This value is subsequently consumed by the IAM/bucket policy evaluation engine in rustfs/src/storage/access.rs, meaning any forged header directly influences authorization decisions. No authentication is required to exploit this — an attacker simply sends a crafted HTTP request with a spoofed header value matching an allowlisted IP range (RustFS Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker with network access to RustFS to bypass IP-allowlist policies enforced via aws:SourceIp conditions in IAM or bucket policies, gaining unauthorized s3:ListBucket, read, or write access to restricted buckets. The primary impact is high integrity loss, as attackers can access or modify data that should be restricted to specific IP ranges. Confidentiality is also implicitly at risk since unauthorized listing and reading of bucket contents is possible. Availability is not directly impacted (RustFS Advisory, GitHub Advisory).

A proof-of-concept (PoC) archive (rustfs-auth-trusted-ip-header-spoofing-poc.tar.gz) was included in the security advisory at the time of disclosure, demonstrating the bypass with a three-step test (baseline 403, spoofed 200, wrong-IP 403). The CVSS v4.0 exploit maturity is rated "Proof of Concept." There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.041–0.054% (17th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (RustFS Advisory, GitHub Advisory).

1. Reconnaissance: Identify RustFS instances running versions prior to 1.0.0-alpha.78 that are network-accessible (e.g., via port scanning on the default port 9000). Confirm the target uses aws:SourceIp conditions in bucket or IAM policies.
2. Identify allowlisted IP: Attempt an unauthenticated ListBucket or similar S3 API request without any spoofed header — a 403 Forbidden response confirms an IP-allowlist policy is in effect. Enumerate or guess the allowlisted IP range (e.g., internal RFC-1918 ranges like 10.0.0.0/8).
3. Craft spoofed request: Construct an HTTP request to the target RustFS S3 endpoint (e.g., GET /?list-type=2) and add the header X-Forwarded-For: <allowlisted_IP> (e.g., X-Forwarded-For: 10.0.0.5).
4. Bypass policy: Send the crafted request. RustFS reads the spoofed header, sets SourceIp to the allowlisted value, and the policy evaluation grants access — returning HTTP 200 with bucket contents instead of 403.
5. Perform unauthorized operations: With the bypass confirmed, issue further S3 API calls (e.g., GetObject, PutObject, DeleteObject) using the same spoofed header to read, write, or delete data in restricted buckets (RustFS Advisory, GitHub Advisory).

• Network: Unexpected HTTP requests to RustFS (default port 9000) containing X-Forwarded-For or X-Real-Ip headers from clients that are not known reverse proxies or load balancers; requests from external IPs presenting internal/allowlisted IP values in these headers.
• Logs: RustFS access logs showing HTTP 200 responses to S3 API calls (e.g., ListBucket, GetObject) from source IPs that do not match the X-Forwarded-For value in the request; repeated access attempts with varying X-Forwarded-For values from the same source IP (enumeration behavior).
• Behavioral: Successful S3 operations on buckets with aws:SourceIp restrictions from IP addresses not in the allowlist; unauthenticated or anonymously-signed requests that succeed against IP-restricted buckets (RustFS Advisory).

Upgrade RustFS to version 1.0.0-alpha.78 or later, which patches the get_condition_values function to validate that forwarded-IP headers originate from trusted proxy infrastructure (RustFS Advisory, GitHub Advisory). As a workaround prior to patching, deploy RustFS behind a trusted reverse proxy that strips and re-sets X-Forwarded-For/X-Real-Ip headers, and use network-level firewall rules to restrict direct client access to the RustFS port. Additionally, consider supplementing or replacing IP-based access control with credential-based authentication mechanisms to reduce reliance on aws:SourceIp conditions alone.

The vulnerability was identified by SecMate (https://secmate.dev) through automated analysis and validated during manual triage, as credited in the official advisory. The advisory was published directly by the RustFS maintainer (loverustfs) on GitHub, indicating prompt vendor response. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been observed (RustFS Advisory).