CVE-2026-21862 | RustFS up to alpha.77 Header get_condition_values X-Forwarded-For/X-Real-Ip authentication spoofing

A vulnerability was found in RustFS up to alpha.77. It has been declared as critical. This vulnerability affects the function get_condition_values of the component Header Handler. The manipulation of the argument X-Forwarded-For/X-Real-Ip results in authentication bypass by spoofing.

This vulnerability was named CVE-2026-21862. The attack may be performed from remote. There is no available exploit.

It is recommended to upgrade the affected component.