CVE-2026-73285

This is a single-boolean initialization error in the OPA authorization path that silently disables s3:ExistingObjectTag/* policy conditions. The vulnerability persisted from alpha.64 through rc.1, meaning organizations using OPA mode for authorization had tag-based access controls—used for data classification, tenant isolation, and compliance—entirely absent from their security posture without any detection signal. The core mechanism: the `needs_existing_object_tag` flag gets set incorrectly for `PreparedIamMode::Opa`, which causes the policy evaluation logic to skip tag condition merging entirely. The system continues processing requests normally, returning success or failure based on other factors, while the tag-based restrictions that administrators configured simply never get evaluated. This is the dangerous silent permissive failure mode—far worse than a hard error that would alert operators to the problem. Two independent failure surfaces exist here. First, the RustFS-side code that determines what to send to OPA had this boolean misconfiguration. Second, the OPA policy artifact itself may have been written assuming tag conditions weren't being passed through. Fixing the code alone doesn't guarantee the policy was updated correctly—organizations should audit their OPA policy definitions to confirm they actually evaluate s3:ExistingObjectTag/* conditions. Architecturally, this represents a mode-specific initialization bug at the seam between native IAM handling and the OPA plugin. The critical gap: no runtime check verifies that configuration flags align with actual policy behavior. The absence of detection is by design—silent permissive failures provide no operational telemetry. The question for teams using similar patterns: do your mode-specific initialization paths have any consistency validation, or are they relying on implicit defaults that could silently disable security controls?

Reviewed through automated stages and approved by a human before publication.