CVE-2026-73288CWE-693CWE-754

CVE-2026-73288

published August 12, 2026

CVSS

6.1

EPSS

Percentile

32.5

In the wild

Unconfirmed

What it is

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.

The record

Technical detail

CVSS: 6.1 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00394 · 32.5th percentile
Weaknesses: CWE-693 · Protection Mechanism Failure; CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published: 2026-08-12T19:18Z

References (4)

https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d · [email protected]https://github.com/rustfs/rustfs/pull/5648 · [email protected]https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1 · [email protected]https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f · [email protected]

EPSS history

Timeline

12 AUG 14:42Z
RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
cvelistv5