CVE-2026-73288 reveals a fundamental design flaw in RustFS, not merely a coding error. When object lock state cannot be determined—due to missing configuration, corrupted metadata, or parse failures—the system interprets this ambiguity as 'no lock configured' and permits deletion. This is fail-open behavior, and for COMPLIANCE retention workloads, fail-open is architecturally wrong by definition.
COMPLIANCE mode exists precisely because organizations need immutable audit trails, legal holds, or regulatory preservation. When uncertainty arises, the system must deny deletion, not assume the absence of constraints. Three code paths exhibit this flaw: check_object_lock_for_deletion, delete_prefix, and lifecycle/scanner sweeps. The scanner sweep path is particularly dangerous because it operates asynchronously with delayed feedback—an overnight garbage collection run that silently prunes 'unparseable' objects causes irreversible data loss without generating anomalous API traffic that defenders would detect.
The secondary attack surface deserves attention. If underlying storage corruption can make object metadata unreadable—whether through induced failure or maintenance operations—attackers gain a deletion pathway without manipulating lock configuration directly. This creates a vector the CVE description doesn't fully characterize.
Verify whether version 1.0.0-rc.1 implements fail-closed semantics across all three code paths, not just the synchronous API. Partial remediation that closes the direct API path while leaving scanner sweeps fail-open passes CVE tracking but fails adversarial review. The scanner path is where cascade damage compounds: one corrupted metadata entry doesn't expose one object—it exposes every object sharing that metadata's blast radius.
The detection gap is the hardest part. Successful exploitation looks indistinguishable from normal housekeeping. No anomalous traffic, no permission errors, no audit events—just objects quietly disappearing during routine operations. Organizations relying on API traffic analysis for breach detection are flying blind.
For compliance contexts, understand that CVSS 6.1 measures recoverability, but COMPLIANCE retention violations have no restoration path. Data legally required to be preserved and deleted cannot be unwound by upgrading. The remediation window isn't just about patching forward—it's about accounting for what's already gone.