by Kastro
Paper/Archive/CVE-2026-45039

CVE-2026-45039

rustfs rustfs — RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 19.0.190 × 203.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, get_shared_secret() in crates/ecstore/src/rpc/http_auth.rs, falls back to the public, source-tree-embedded DEFAULT_SECRET_KEY = "rustfsadmin" when neither the RUSTFS_RPC_SECRET environment variable nor the global S3 secret key has been configured. This vulnerability is fixed in 1.0.0-beta.2.

Affected

ProductAffectedFixed inSource
rustfs< 1.0.0-beta.2–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/rustfs/rustfs/security/advisories/GHSA-r5qv-rc46-hv8q