CVE-2026-45039
CRITICAL EPSS 18.4%
Published May 28, 20261mo ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Published May 28, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, get_shared_secret() in crates/ecstore/src/rpc/http_auth.rs, falls back to the public, source-tree-embedded DEFAULT_SECRET_KEY = "rustfsadmin" when neither the RUSTFS_RPC_SECRET environment variable nor the global S3 secret key has been configured. This vulnerability is fixed in 1.0.0-beta.2.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
18.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-1392
CWE-798 Use of Hard-coded Credentials Authentication
References 1
- github.com https://github.com/rustfs/rustfs/security/advisories/GHSA-r5qv-rc46-hv8q
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.