CVE-2026-45039 Details
Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, get_shared_secret() in crates/ecstore/src/rpc/http_auth.rs, falls back to the public, source-tree-embedded DEFAULT_SECRET_KEY = "rustfsadmin" when neither the RUSTFS_RPC_SECRET environment variable nor the global S3 secret key has been configured. This vulnerability is fixed in 1.0.0-beta.2.
A vulnerability in RustFS, a distributed object storage system, allows for internode RPC authentication bypass, enabling peer impersonation. This issue affects RustFS versions prior to 1.0.0-beta.2. The vulnerability arises because the RPC layer authenticates requests using an HMAC-SHA256 signature derived from a shared secret. When the RUSTFS_RPC_SECRET environment variable or the global S3 secret key is not set, the shared secret defaults to 'rustfsadmin', a hard-coded credential. This fallback allows any entity that can access the RPC port to impersonate a peer node and execute arbitrary internode RPC commands, such as managing disks or data replication.
Users should update to RustFS version 1.0.0-beta.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rustfs/rustfs/security/advisories/GHSA-r5qv-rc46-hv8q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1392 | Use of Default Credentials | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RustFS | <= 1.0.0-beta.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |