RustFS exposes a permissive cross-domain policy when the RUSTFS_CORS_ALLOWED_ORIGINS variable is left unset. The S3 listener reflects whatever Origin header is supplied in the request back as Access‑Control‑Allow‑Origin and also emits Access‑Control‑Allow‑Credentials: true, effectively allowing any website to access responses from the RustFS endpoint. Because browsers include ambient credentials such as HTTP Basic Auth data, SSO cookies, or TLS client certificates automatically, an attacker can provoke a victim’s browser to retrieve sensitive data that was meant to be browser‑specific. This flaw does not allow arbitrary code execution, but it does enable credential‑based data exfiltration across origins.

The affected product is RustFS, a distributed object storage system written in Rust. All deployments on versions released before 1.0.0‑beta.2 that do not configure RUSTFS_CORS_ALLOWED_ORIGINS are vulnerable. No other vendors or product variants are mentioned in the advisory.

The CVSS score of 6 indicates a moderate to high severity. The EPSS score is not available, and this vulnerability is not listed in the CISA KEV catalog, implying that large‑scale public exploitation is not yet documented. The likely attack vector is a browser‑based Cross‑Origin Resource Sharing (CORS) request from an attacker‑controlled site. An attacker can only gain access if a victim’s browser holds valid credentials for the RustFS origin; otherwise the request will not be fulfilled. The exploitation therefore requires a victim with stored credentials to unintentionally conduct a request to a malicious page, which is a realistic threat in many company environments using shared browsers or SSO cookies.