{"apiVersion":"1.0","identifier":"CVE-2026-73289","description":"RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other-s semantics because crates/policy/src/policy/function/string.rs negates the aggregate result after eval or eval_like instead of negating each request-value predicate before quantification. Partially overlapping policy and request value sets can therefore make an Allow condition grant access to an excluded principal or make a Deny guardrail fail, including policies based on jwt:groups and jwt:roles; absent keys also receive the opposite ForAllValues: and ForAnyValue: behavior. This issue is fixed in version 1.0.0-beta.12.","publishedAt":"2026-08-12T15:18:32","lastModifiedAt":"2026-08-12T15:18:32","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73289","cvssScore":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","epssProbability":0.00231,"riskScore":0.83,"affectedProduct":"RustFS","affectedVersions":"<1.0.0-beta.12","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73289","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73289","en":"https://www.redsauce.net/en/cves/CVE-2026-73289","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73289","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73289","de":"https://www.redsauce.net/de/cves/CVE-2026-73289","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73289","el":"https://www.redsauce.net/el/cves/CVE-2026-73289"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73289"}}