PT-2026-3260 · Rustfs · Rustfs

Rand-Tech · Published 2026-01-11 · Updated 2026-02-09 · CVE-2026-22782

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79

Description RustFS is a distributed object storage system built in Rust. Invalid RPC signatures cause the server to log the shared HMAC secret and the expected signature. This exposes the secret to log readers, potentially enabling forged RPC calls. The issue resides in the crates/ecstore/src/rpc/http auth.rs file, specifically within the invalid signature branch, where sensitive data is logged. Any invalidly signed request triggers this logging, and the function is accessible from RPC and admin request handlers. The logged information includes the secret and expected signature, both derived from the shared HMAC key.

Recommendations Upgrade to RustFS version 1.0.0-alpha.80 or later.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2026-00684

CVE-2026-22782

GHSA-333V-68XH-8MMQ

Affected Products

Rustfs

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22782.json · Exploit
• https://github.com/rustfs/rustfs/security/advisories/GHSA-333v-68xh-8mmq · Vendor Advisory
• https://github.com/rustfs/rustfs/blob/9e162b6e9ebb874cc1d06a7b33bc4a05786578aa/crates/ecstore/src/rpc/http_auth.rs#L115-L122 · Patch
• https://github.com/rustfs/rustfs/commit/6b2eebee1d07399ef02c0863bd515b4412a5a560 · Patch
• https://bdu.fstec.ru/vul/2026-00684 · Security Note
• https://osv.dev/vulnerability/GHSA-333v-68xh-8mmq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22782 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22782 · Vendor Advisory
• https://github.com/rustfs/rustfs · Note
• https://twitter.com/ytroncal/status/2012922546270707825 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2012228012104663074 · Twitter Post
• https://t.me/cveNotify/151474 · Telegram Post
• https://twitter.com/_cvereports/status/2012571489921319224 · Twitter Post
• https://twitter.com/CVEnew/status/2012303242563305860 · Twitter Post