RustFS is a distributed object storage system built in Rust. The vulnerability occurs in the object lock enforcement module, where the code treats missing or unreadable bucket metadata as if no lock configuration existed. This allows an attacker to delete or expire objects that are protected by COMPLIANCE retention rules, effectively bypassing the intended Write‑Once‑Read‑Many (WORM) protection. The flaw is a protection‑mechanism failure (CWE‑693) that can result in loss of compliant data and violations of regulatory requirements.

The flaw affects any RustFS deployment running a version prior to 1.0.0‑rc.1. Versions of RustFS that include the ecstore crate before the 1.0.0‑rc.1 release are vulnerable. The fix is introduced in release 1.0.0‑rc.1 and later.

The vulnerability has a CVSS score of 6.1, indicating moderate severity. EPSS is not available, and the issue is not listed in CISA's KEV catalog. The likely attack vector is through any API that performs object deletion, lifecycle sweeps, or prefix deletions; systems that allow users or scripts to trigger these operations can exploit the flaw. Because the bug is a logical oversight that ignores metadata existence checks, the exploit does not require privileged code execution or exploitation of underlying storage layers—appropriate delete privileges on a bucket are sufficient.