CVE-2026-39360

CVE-2026-39360 is a missing authorization vulnerability in RustFS, a distributed object storage system written in Rust, affecting versions prior to alpha.90. The flaw exists in the multipart copy functionality (UploadPartCopy), where inadequate access controls allow low-privileged users to exfiltrate objects from victim buckets by copying them into attacker-controlled multipart uploads. This vulnerability compromises tenant isolation in multi-user and multi-tenant deployments. The vulnerability has a CVSS score of 4.3 (Medium) with a network-based attack vector requiring only low-level privileges and no user interaction. The attack is relatively straightforward to execute given the low attack complexity, resulting in limited confidentiality impact through unauthorized data exposure. However, integrity and availability are not affected. This vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog and shows no signs of active exploitation. The EPSS score of 0.0003 indicates extremely low likelihood of exploitation in the wild. Given that RustFS remains in alpha development status, community awareness and adoption are likely limited, reducing the immediate threat landscape. The vulnerability was addressed in alpha.90, and organizations using RustFS should prioritize upgrading to this or later versions.