RustFS Flaw: Non-Admin Takeover of Notification Targets

The National Vulnerability Database (NVD) has disclosed CVE-2026-40937, a high-severity vulnerability (CVSS 8.3) in RustFS, a distributed object storage system. Prior to version 1.0.0-alpha.94, RustFS’s admin API endpoints for notification targets failed to perform proper authorization checks. Specifically, the check_permissions helper in rustfs/src/admin/handlers/event.rs only validated authentication (access key and session token), completely bypassing the validate_admin_request function which enforces specific AdminAction authorization.

This critical oversight allows any authenticated non-admin user to overwrite shared, admin-defined notification targets by name. The implications are severe: an attacker can redirect subsequent bucket events to an endpoint they control. This isn’t just a misconfiguration risk; it enables cross-user event interception and provides a clear path for audit evasion.

For defenders, this means a non-privileged user can effectively blind security teams to critical events or reroute sensitive data notifications. The NVD reports that version 1.0.0-alpha.94 contains the necessary patch. Organizations leveraging RustFS must prioritize this update to prevent unauthorized event manipulation and maintain data integrity and audit trails.