Critical XSS Flaw in RustFS Exposes S3 Storage to Total Admin Account Takeovers
Do Son 
RustFS is an open-source, high-performance distributed object storage system that is built in the Rust programming language. It is optimized for AI, big data workloads, and data lakes while offering full S3 compatibility. The platform aims to combine the memory safety and raw performance of Rust with the simplicity of MinIO.
However, administrators must take immediate action due to the disclosure of CVE-2026-27822, a critical Stored Cross-Site Scripting (XSS) vulnerability carrying a CVSS score of 9.1. This flaw resides in the RustFS preview modal and can lead to a complete administrative account takeover.
The core issue stems from a lack of origin separation between the management console and the S3 object delivery, paired with improper validation of the response content type during the file preview process. By default, the RustFS Console stores highly sensitive S3 credentials, including the AccessKey, SecretKey, and SessionToken, directly in the browser’s localStorage.
When an administrator attempts to preview a file, the application uses an <iframe> to render the file based on its metadata or extension. Because RustFS typically hosts the S3 API and the management console on the exact same origin, a dangerous bypass attack becomes possible.
A malicious actor can simply upload a file named xss.pdf but manipulate its Content-Type metadata to read text/html. When the victim opens the preview, the <iframe> executes the embedded script, which then enjoys unrestricted access to the parent window’s localStorage. By bypassing the PDF preview logic, the attacker can silently steal the administrator credentials.
This vulnerability specifically targets System Administrators using the Console and results in a full Account Takeover (ATO). With the stolen AccessKeyId, SecretAccessKey, and Session Token, the attacker can execute any administrative action. This level of access grants the ability to download the entire filesystem via the S3 API, delete critical data, or create persistent backdoors.
The vulnerability affects all RustFS versions prior to 1.0.0-alpha.82. Organizations should immediately upgrade to the patched version, 1.0.0-alpha.83.
In addition to applying the patch, security teams are advised to implement the following architectural mitigations:
- Origin Separation: Implement a dedicated domain for data delivery that is completely different from the console domain in order to isolate user-uploaded content via the Same-Origin Policy.
- Strict Security Headers: Enforce backend headers such as a Content-Security-Policy (CSP) to restrict script execution and disallow inline scripts.
- Prevent Sniffing: Utilize X-Content-Type-Options: nosniff to prevent browsers from executing content that contradicts its declared type.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
