RustFS, a distributed object storage system, contains a flaw in handling the FTPS MKD command that bypasses IAM authorization for the S3 Action CreateBucket. When an authenticated FTPS user executes MKD, the system calls storage.create_bucket without checking the s3:CreateBucket policy, allowing a user who has been denied that permission to create new buckets. This creates an authorization bypass that permits bucket creation without the necessary privileges.

The vulnerability exists in RustFS versions prior to 1.0.0-beta.12. The affected product is rustfs:rustfs, and any deployment of earlier releases may allow this bypass if users can authenticate via FTPS.

The CVSS score of 5.4 indicates moderate severity. EPSS information is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. The attack requires an existing FTPS user account with credentials; the attacker can issue MKD to create buckets. No evidence suggests the flaw can be exploited remotely without user credentials or privilege escalation beyond the authenticated user role.