Stored XSS Vulnerability in RustFS Console Exposes Admin S3 Credentials

Cyberpress

Stored XSS Vulnerability in RustFS Console Exposes Admin S3 Credentials

First seen 28 Feb 2026, 18:10 UTC • •34.1

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

A stored cross-site scripting (XSS) vulnerability in the RustFS Console has been identified, allowing attackers to steal admin S3 credentials. This flaw poses a significant risk of full account takeovers for affected users. The issue was reported on February 27, 2026, and has been confirmed by multiple cybersecurity sources.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 182d ago How this analysis works

Timeline

2026-02-27

Vulnerability reported in RustFS Console

2026-02-28

Cyberpress publishes details on the XSS flaw

More articles in this cluster (2)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Affected Platform (1)

RustFS Console

Vulnerability (2)

XSS
Stored XSS

Relationships

XSS targets RustFS Console
Stored XSS targets RustFS Console

Continue Reading

Critical Exploitation of Sangoma Switchvox Vulnerabilities Underway Sangoma Switchvox SMB Edition 8.3 is facing active exploitation of multiple vulnerabilities, particularly CVE-2026-9586, which allows unauthenticated SQL injection leading to remote code execution. The flaw can be exploited by sending crafted HTTP POST requests to the /pa endpoint, enabling attackers to execute…

Critical Stored XSS Vulnerabilities Found in SiYuan Versions Before 3.7.4 Two critical vulnerabilities, CVE-2026-73050 and CVE-2026-73052, have been identified in SiYuan versions prior to 3.7.4. CVE-2026-73050 allows attackers to exploit stored cross-site scripting (XSS) via unescaped color fields in select options, executing arbitrary JavaScript in victim browsers. CVE-2026-73052 enables…