RustFS, a Rust‑based distributed object storage, contains a flaw in its identity and access management layer. The deny_only short‑circuit allows a constrained service account or short‑term security credential to mint a new, unrestricted service account that inherits the full privileges of its parent. The result is an attacker able to run arbitrary commands, read or write protected data, or otherwise gain unrestricted access. This issue is rooted in improper authority and access control checks as reflected by CWE‑269 and CWE‑284.

The vulnerability affects RustFS releases 1.0.0‑alpha.13 through 1.0.0‑alpha.78. The affected vendor is RustFS, and the product is the RustFS object storage system. Versions newer than 1.0.0‑alpha.78, notably 1.0.0‑alpha.79 and later, have the bug resolved.

The CVSS score of 5.7 indicates a medium severity. EPSS is less than 1%, implying a low yet non‑zero chance of active exploitation. KEV does not list the issue, suggesting no confirmed exploitation at the time of analysis. The flaw requires the attacker to already possess a restricted service account or an STS credential; once that authentication is available, the attacker can elevate privileges by minting a new unrestricted account. Attackers would typically perform this within an environment where IAM delegation is enabled.