CVE-2026-73288
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In RustFS prior to 1.0.0-rc.1, Object Lock enforcement lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired.
Risk Assessment
Risk of violating data integrity and legal retention requirements. Objects under retention may be permanently deleted or expired, leading to data loss and non-compliance.
Recommendation
Update RustFS to version 1.0.0-rc.1 or later, which includes the fix. Ensure that object metadata is always readable and correctly parsed.
Original NVD description (English source)
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.