{"action":"Upgrade rustfs to 1.0.0-alpha.79 or later.","affected":[{"fixed":"1.0.0-alpha.79","introduced":"1.0.0-alpha.13"}],"component":"rustfs","cve_ids":["CVE-2026-22043"],"ecosystem":"crates.io","epss":0.00419,"exploited":false,"fixed_versions":["1.0.0-alpha.79"],"ghsa_id":"GHSA-xgr5-qc6w-vcg9","id":"tcs_01M5KF4QPFS8CDT099E1VDH51F","modified_at":"2026-02-03T03:16:08.570527Z","published_at":"2026-01-08T20:40:06Z","references":["https://osv.dev/vulnerability/GHSA-xgr5-qc6w-vcg9","https://github.com/rustfs/rustfs/security/advisories/GHSA-xgr5-qc6w-vcg9","https://nvd.nist.gov/vuln/detail/CVE-2026-22043","https://github.com/rustfs/rustfs"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-xgr5-qc6w-vcg9","url":"https://osv.dev/vulnerability/GHSA-xgr5-qc6w-vcg9"}],"summary":"RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting"}