# RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks

RustFS notification target admin endpoints skipped admin authorization, letting a readonly user hijack webhook targets and exfiltrate bucket event data.

- Payout: Research
- Severity: high
- Program: RustFS
- Found by: kodareef5
- Disclosed: 2026-04-22
- CVE: CVE-2026-40937
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-pfcq-4gjr-6gjm
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-pfcq-4gjr-6gjm
- Tags: area:cloud domain:cloud impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:rest technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure vuln:ssrf

**Target:** Admin notification target API endpoints (event.rs) in RustFS object storage
**Root cause:** All four notification target admin handlers use a check_permissions helper that only validates authentication (access key + session token) and never calls validate_admin_request with an AdminAction, unlike every other admin handler.
**Steps:**
1. Authenticate as a readonly (non-admin) user with valid access key and session token.
2. Send `PUT` to the notification target admin endpoint to create/overwrite a target by name; observe 200 instead of 403.
3. Send `GET` list and `GET` arns and `DELETE` to the same endpoints; all return 200 for readonly user while control routes (list-users, kms/status) return 403.
4. Overwrite an admin-configured target URL by name with an attacker-controlled endpoint.
5. Trigger bucket events; observe event bodies delivered to the attacker listener containing object keys, bucket names, user identities and request metadata.
6. Optionally delete unbound targets to evade audit.
**How found:** Code review of admin handlers: noticed event.rs was the only admin handler file not calling validate_admin_request, then confirmed live with a readonly user across all four endpoints and control routes.
**Exploitation:** A readonly user overwrites a shared admin-defined notification target by name, redirecting subsequent S3 bucket events to an attacker-controlled webhook endpoint, capturing object keys, bucket names, user identities and request metadata; unbound targets can also be deleted for audit evasion.
**Escalation:** SSRF via health probe: HEAD request from the rustfs container to an attacker-controlled listener with no host validation (only scheme check http/https).
**Insight:** When auditing admin APIs, diff every handler against the canonical authorization helper — a single file that only checks authentication (access key/session) but omits the admin-action check is a reliable signal; also test shared named resources for cross-tenant overwrite.