Is rustfs safe to use? Its security history

Every advisory, newest first

• VulnerabilityGHSA-mm2q-qcmx-gw4w · 2026-05-05RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover
• VulnerabilityGHSA-pfcq-4gjr-6gjm · 2026-04-22RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
• VulnerabilityGHSA-mx42-j6wv-px98 · 2026-04-08RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration
• VulnerabilityGHSA-v9fg-3cr2-277j · 2026-02-25Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
• VulnerabilityGHSA-w5fh-f8xh-5x3p · 2026-02-25RustFS: Missing Post Policy Validation leads to Arbitrary Object Write
• VulnerabilityGHSA-r54g-49rx-98cr · 2026-02-03RustFS Logs Sensitive Credentials in Plaintext
• VulnerabilityGHSA-fc6g-2gcp-2qrq · 2026-02-03RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers
• VulnerabilityGHSA-333v-68xh-8mmq · 2026-01-16RustFS's RPC signature verification logs shared secret
• VulnerabilityGHSA-xgr5-qc6w-vcg9 · 2026-01-08RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting
• VulnerabilityGHSA-vcwh-pff9-64cc · 2026-01-08RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation
• VulnerabilityGHSA-gw2x-q739-qhcr · 2026-01-07RustFS gRPC GetMetrics deserialization panic enables remote DoS
• VulnerabilityGHSA-pq29-69jg-9mxc · 2026-01-07RustFS Path Traversal Vulnerability
• VulnerabilityGHSA-h956-rh7x-ppgj · 2025-12-30RustFS has a gRPC Hardcoded Token Authentication Bypass

Check your version

Run cargo tree -i rustfs to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.

RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.