RustFS permits users who have permission to read current objects to read historical object versions by using the standard GetObject, CopyObject, and UploadPartCopy operations. These operations are authorized with s3:GetObject instead of s3:GetObjectVersion, meaning that principals lacking explicit version-read rights can obtain known historical object content. The vulnerability therefore allows a confidentiality breach of any previously stored objects that a user can reference by version ID, exposing sensitive data that was not intended to be publicly accessible.

The rustfs storage system is affected for all releases prior to version 1.0.0‑beta.11. The issue is fixed in that release and later versions, so any rustfs instance running an older version is vulnerable.

The CVSS score of 6.5 indicates a medium severity vulnerability, and the EPSS score is unavailable. RustFS is not listed in the CISA KEV catalog. Exploitation is straightforward: an attacker who can use the S3 API to provide a versionId (e.g., via a GetObject request) and has s3:GetObject permission can retrieve historical object data without needing separate version‑specific permissions. Because the attack vector is the normal S3 interface and does not require advanced privileges, the likelihood of exploitation is reasonably high compared to other medium‑severity issues. Monitoring for anomalous version reads or applying tighter IAM controls can reduce the risk until a fix is applied.