Medium · published January 8, 2026
⚠️ There’s a sneaky permissions mix-up in RustFS that could let the wrong folks tinker with your IAM settings! Think of it like a restaurant where only the delivery drivers can access the kitchen. However, someone forgot to check credentials, so now those drivers can also start cooking up new dishes or tossing out the old ones without anyone noticing! If exploited, an attacker with export-only permissions could perform privileged actions, such as creating or updating users and policies, thereby gaining unauthorized access and escalating their privileges. The result? A recipe for chaos in your IAM setup!
Think of it like a restaurant where only the delivery drivers can access the kitchen. However, someone forgot to check credentials, so now those drivers can also start cooking up new dishes or tossing out the old ones without anyone noticing! This vulnerability arises because the `ImportIam` admin API incorrectly validates permissions with `ExportIAMAction` instead of the proper `ImportIAMAction`, allowing unauthorized import operations for users who should only have export capabilities.
If exploited, an attacker with export-only permissions could perform privileged actions, such as creating or updating users and policies, thereby gaining unauthorized access and escalating their privileges. The result? A recipe for chaos in your IAM setup! To secure your system, make sure to update RustFS to version 1.0.0-alpha.79 or later immediately. Also, review your IAM permissions to ensure that they are correctly configured and restrictive enough to prevent unauthorized access. You’ve got this! With these steps, you’ll keep your IAM secure and your systems running smoothly. 🛡️