VulnSocial

CVE-2026-49991Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 2 mentions (2026-06-27); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-06-04: 1Mentions · 2026-06-27: 2Mentions · 2026-06-29: 1Technical Details · 2026-06-27: 1Technical Details · 2026-06-29: 106-0406-2706-29
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-041
Disclosure1
2026-06-272
Disclosure2
2026-06-291
Disclosure1
Full discourse4 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-49991 RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a pat… https://www.cve.org/CVERecord?id=CVE-2026-49991

    Post summary

    The text announces a vulnerability in RustFS 1.0.0-beta.4, noting that authenticated users with PutObject permission can exploit an issue, but provides no PoC, exploit, patch, or evidence of active exploitation.

    00020957
    58.0K followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    #CVE-2026-49991 - Critical path traversal in #RustFS. Authenticated users can write objects to other tenants' buckets via #Snowball auto-extract, breaking isolation. #CVSS 8.6. Unpatched. Mitigate immediately. #CVEAlert #infosec #developers #redteam #blueteam more info: https://www.valtersit.com/cve/CVE-2026-49991/

    Post summary

    A new critical path‑traversal vulnerability (CVE‑2026‑49991) in RustFS allows authenticated users to write objects to other tenants’ buckets via Snowball auto‑extract, breaking isolation. The CVSS score is 8.6, it remains unpatched, and immediate mitigation is recommended.

    00000102
    965 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-49991 RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a pat… https://www.cve.org/CVERecord?id=CVE-2026-49991 ----- Traducción: CVE-2026-49991 Rus… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-49991 in RustFS, noting that users with limited PutObject permission can exploit the issue, but provides no PoC, exploit code, active exploitation evidence, or mitigation information.

    0000068
    89 followersView on X
  • えりす@eris_dev
    Disclosure

    初cve獲得❗️ CVE-2026-49991 mythosとか出てきてもう価値ないんかな、 https://github.com/rustfs/rustfs/security/advisories/GHSA-f4vq-9ffr-m8m3

    Post summary

    The user announces acquisition of CVE-2026-49991 and links to the GitHub advisory for rustfs, but provides no details on exploitation, remediation, or patches.

    0000058
    13 followersView on X

Explore more

Back to dashboard