CVE-2026-73288

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d
https://github.com/rustfs/rustfs/pull/5648
https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1
https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-12 15:18

Updated : 2026-09-09 21:02

NVD link : CVE-2026-73288

Mitre link : CVE-2026-73288

CVE.ORG link : CVE-2026-73288

JSON object : View

Products Affected

No product.

CWE

CWE-693

Protection Mechanism Failure

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2026-73288", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73288", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T22:09:08.035456Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rustfs", "product": "rustfs", "versions": [{"status": "affected", "version": "< 1.0.0-rc.1"}]}]}], "published": "2026-08-12T15:18:32.447", "references": [{"url": "https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d", "source": "security-advisories@github.com"}, {"url": "https://github.com/rustfs/rustfs/pull/5648", "source": "security-advisories@github.com"}, {"url": "https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}, {"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1."}], "lastModified": "2026-09-09T21:02:22.660", "sourceIdentifier": "security-advisories@github.com"}