CVE-2026-22782

LOW EPSS 37.3%
Published Jan 16, 20265mo ago · Modified Jun 17, 20262w ago
2.9 CVSS 4.0
Low
Find Similar
Published Jan 16, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. This vulnerability is fixed in 1.0.0-alpha.80.

CVSS Details

Base Score
2.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
37.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-532

Affected Products 79

VendorProductVersionRange
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any
rustfsrustfs1.0.0any

References 3

  • github.com https://github.com/rustfs/rustfs/blob/9e162b6e9ebb874cc1d06a7b33bc4a05786578aa/crates/ecstore/src/rpc/http_auth.rs#L115-L122
    Patch
  • github.com https://github.com/rustfs/rustfs/commit/6b2eebee1d07399ef02c0863bd515b4412a5a560
    Patch
  • github.com https://github.com/rustfs/rustfs/security/advisories/GHSA-333v-68xh-8mmq
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/rustfs/rustfs/blob/9e162b6e9ebb874cc1d06a7b33bc4a05786578aa/crates/ecstore/src/rpc/http_auth.rs#L115-L122
    Patch
  • github.com https://github.com/rustfs/rustfs/commit/6b2eebee1d07399ef02c0863bd515b4412a5a560
    Patch