CVE-2026-40937
- Source
- https://cve.org/CVERecord?id=CVE-2026-40937
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40937.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-40937
- Aliases
- Published
- 2026-04-22T20:15:57Z
- Modified
- 2026-10-21T02:57:10Z
- Severity
-
- 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
- Summary
- RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks
- Details
-
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in
rustfs/src/admin/handlers/event.rsuse acheck_permissionshelper that validates authentication only (access key + session token), without performing any admin-action authorization viavalidate_admin_request. Every other admin handler in the codebase correctly callsvalidate_admin_requestwith a specificAdminAction. This is the only admin handler file that skips authorization. A non-admin user can overwrite a shared admin-defined notification target by name, causing subsequent bucket events to be delivered to an attacker-controlled endpoint. This enables cross-user event interception and audit evasion. 1.0.0-alpha.94 contains a patch. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40937.json" }- References
Affected packages
Git / github.com/rustfs/rustfs
Affected ranges
- Type
- GIT
- Repo
- https://github.com/rustfs/rustfs
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "1.0.0-alpha.94" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "original_tag": "1.0.0-alpha.94", "range": [ { "fixed": "c0d3f53f7ad1b4267e6760d48845928b06ea1ea4" } ], "source": "REFERENCES_TAG" }, { "range": [ { "introduced": "0" }, { "fixed": "1.0.0-alpha.94" } ], "source": "DESCRIPTION" } ] }