Vultr Object Storage
Vultr Object Storage is S3-compatible. The S3 ACL model (`public-read`, `public-read-write`, `private`) applies directly to `<region>.vultrobjects.com` buckets.
Vultr Object Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
Vultr exposes the same minio-based control plane as several other S3-compatible providers. Operator confusion across providers means an ACL set "the AWS way" sometimes maps to a more permissive equivalent on Vultr.
Real-world impact
Public ACL grants enumeration and download of all objects. `public-read-write` additionally lets anonymous callers upload, which is a vector for hosting malware on someone else's storage bill.
Remediation
- Set the bucket ACL to `private`; explicitly grant only the IAM principals that need access.
- For public asset distribution, front the bucket with Vultr CDN and presigned URLs.
URL patterns
Vultr Object Storage buckets typically resolve under hostnames like:
example.ewr1.vultrobjects.comexample.fra1.vultrobjects.com
Check a specific Vultr Object Storage URL
Paste any Vultr Object Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Vultr Object Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request