Stored XSS Vulnerability in RustFS Console Puts S3 Admin Credentials at Risk

**Executive Summary:** RustFS Console contains a critical Stored XSS (CVE-2026-27822, CVSS 10.0) where previewing a file with a forged Content-Type in a same-origin iframe can execute attacker-controlled JavaScript, allowing theft of S3 admin credentials from localStorage and enabling full account takeover; users should upgrade to 1.0.0-alpha.83 and implement origin separation, CSP, and X-Content-Type-Options to mitigate.