CyberRota Analysis
AI-GeneratedRustFS versions from 1.0.0-alpha.64 to 1.0.0-rc.1 contain a vulnerability that allows authenticated users to bypass tag-based policy restrictions due to incorrect handling of object tags in the external OPA authorization process. This could lead to unauthorized access to sensitive data stored in the system. Organizations using affected versions should prioritize upgrading to version 1.0.0-rc.1 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1.