CVE-2026-45041 Details
Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named TEST_PRIVATE_KEY and uses it in production via parse_license() to "verify" license tokens. Because the key is embedded in every published source release and binary, anyone who can read the repository or extract it from the binary can mint arbitrary license tokens (any subject, any expiration). When the license Cargo feature is enabled, this defeats the entire license-enforcement mechanism. This vulnerability is fixed in 1.0.0-beta.2.
A vulnerability exists in RustFS versions prior to 1.0.0-beta.2, where a 2048-bit RSA private key is hard-coded in the source as 'TEST_PRIVATE_KEY' and used in production to verify license tokens. This key is included in every source release and binary, enabling anyone with access to the repository or the binary to create fake license tokens for any subject and expiration. When the license feature is active, this bypasses the license enforcement system. The issue arises from the improper use of RSA encryption for validation, as it does not authenticate the issuer but only protects confidentiality.
Users should update to RustFS version 1.0.0-beta.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rustfs/rustfs/security/advisories/GHSA-923g-jp7v-f97f | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/rustfs/rustfs/security/advisories/GHSA-923g-jp7v-f97f | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RustFS | <= 1.0.0-beta.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |