A flaw in the PUT /rustfs/admin/v3/import-iam endpoint allows a user holding the ImportIAMAction privilege to create service accounts under any parent identity, including the root user (minioadmin). The endpoint accepts attacker‑controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This defect permits an attacker to create a persistent, attacker‑defined credential with full administrative rights, effectively giving the attacker complete control over the RustFS cluster. The weakness maps to CWE‑269 (Improper Authentication) and CWE‑284 (Improper Access Control).

The vulnerability affects the RustFS distributed object storage system released by rustfs:rustfs. Versions earlier than 1.0.0‑beta.2 are susceptible. The affected system is any deployment exposing the RustFS API with an account that has the ImportIAMAction capability.

The CVSS score of 9.3 indicates a high severity for this privilege escalation flaw. No EPSS score is publicly available at this time, and the vulnerability is not listed in the CISA KEV catalog, but the impact is significant. Exploitation requires network access to the vulnerable API endpoint and an authenticated user with ImportIAMAction rights. Once the backdoor account is created, the attacker can fully compromise the cluster, making timely mitigation critical.