Stored XSS Vulnerability in RustFS Console Puts S3 Admin Credentials at Risk

Cybersecurity: RustFS Console Vulnerability

A critical security vulnerability has been identified in the RustFS Console, posing a significant risk of account takeover.

The vulnerability, tracked as CVE-2026-27822, is a Stored Cross-Site Scripting (XSS) issue with a critical CVSS v3 score of 10.0. It affects Rust package versions prior to 1.0.0-alpha.82. This flaw allows attackers to execute arbitrary JavaScript within the management console, potentially leading to a complete system compromise.

The vulnerability arises from improper validation of response content types during file previews and a lack of origin separation between S3 object delivery and the management console. RustFS typically hosts both the management console and the S3 API on the same origin, creating a Same-Origin vulnerability.

Technical Metric Vulnerability Details

CVE ID CVE-2026-27822

GitHub Advisory GHSA-v9fg-3cr2-277j

Vulnerability Type Stored Cross-Site Scripting (XSS)

Patched Version 1.0.0-alpha.83

Severity Score Critical (/ 10)

When a file is previewed, the application uses an <iframe> to render content based on the file extension but fails to strictly validate the actual content type.

The RustFS Console insecurely stores sensitive S3 credentials, such as AccessKey, SecretKey, and SessionToken, in the browser's localStorage . Since the <iframe> used for previews is hosted on the same origin as the console, any script within that frame can access the parent window's data.

An attacker can exploit this by uploading a malicious file, such as an HTML file containing JavaScript, with a .pdf extension and setting the Content-Type metadata to text/html . When an administrator previews this file, the browser executes the embedded JavaScript.

The impact of this Stored XSS vulnerability is severe, enabling complete Account Takeover (ATO) by exploiting stolen S3 credentials. This allows attackers to perform administrative actions, including data deletion and unauthorized downloads.

To mitigate this threat, RustFS users must update to version 1.0.0-alpha.83. Long-term security measures include:

Origin Separation: Implement a dedicated domain for data delivery, distinct from the console domain, to leverage the Same-Origin Policy (SOP). Security Headers: Enforce strict security headers, such as a Content-Security-Policy (CSP) and X-Content-Type-Options: nosniff , to prevent unauthorized script execution.

Administrators are urged to apply the patch immediately to secure their RustFS deployments.

Based on reporting by GBHackers.