7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-21862

CVE-2026-21862: RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: get_condition_values trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy IP-allowlist policies. This issue has been patched in version alpha.78.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-21862

CVE-2026-21862:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rustfs	rust	< 1.0.0-alpha.78	1.0.0-alpha.78

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker to bypass IP-based access controls by spoofing the X-Forwarded-For or X-Real-IP headers. The root cause is located in the rustfs::auth::get_condition_values function within rustfs/src/auth.rs.

Prior to the patch, this function would read the aforementioned headers to determine the remote_addr, which was then used to evaluate aws:SourceIp conditions in IAM and bucket policies. The patch rectifies this by changing the application to obtain the client's IP address directly from the underlying socket connection at the server level (rustfs/src/server/http.rs). This trusted IP address is then passed down through the call stack as a new remote_addr parameter to get_condition_values. The vulnerable code that read the headers inside get_condition_values was removed. This ensures that the real client IP address is used for security policy evaluation, preventing spoofing.

Vulnerable functions

rustfs::auth::get_condition_values

rustfs/src/auth.rs

The function `get_condition_values` was vulnerable because it determined the client's IP address by reading the `x-forwarded-for` and `x-real-ip` HTTP headers. An attacker could provide a forged value in these headers to spoof their IP address, thus bypassing IP-based access control policies (aws:SourceIp). The function did not validate whether the request came from a trusted proxy before trusting the headers.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.