---
id: CVE-2026-73288
title: RustFS is a distributed object storage system built in Rust
summary: >-
  RustFS is a distributed object storage system built in Rust. Prior to
  1.0.0-rc.1, RustFS Object Lock enforcement in
  crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets
  check_object_lock_for_deletion, delete_prefix, and lifecycle…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-693
  - CWE-754
vendor: rustfs
product: rustfs
affected:
  - rustfs < 1.0.0-rc.1
published: '2026-08-12'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:02:22.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73288'
references:
  - url: >-
      https://github.com/rustfs/rustfs/commit/98d3619613722308498494d412797a52ea8ae64d
    label: security-advisories@github.com
  - url: 'https://github.com/rustfs/rustfs/pull/5648'
    label: security-advisories@github.com
  - url: 'https://github.com/rustfs/rustfs/releases/tag/1.0.0-rc.1'
    label: security-advisories@github.com
  - url: 'https://github.com/rustfs/rustfs/security/advisories/GHSA-j548-9grx-fh4f'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-12T22:09:08.035456Z'
cvssSource: cna
ingestedAt: '2026-09-11T09:10:22.335Z'
epss: 0.00245
epssPercentile: 0.15963
---

## Overview

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired. This issue is fixed in version 1.0.0-rc.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.