PT-2026-44467 · Rustfs · Rustfs

Skandragon · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-45039

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.2

Description The internode RPC layer authenticates requests using an HMAC-SHA256 signature with a shared secret. The function get shared secret() in crates/ecstore/src/rpc/http auth.rs defaults to a public, source-tree-embedded key DEFAULT SECRET KEY ("rustfsadmin") if the RUSTFS RPC SECRET environment variable and the global S3 secret key are not configured.

Recommendations Update to version 1.0.0-beta.2. Configure the RUSTFS RPC SECRET environment variable or the global S3 secret key to avoid the use of the default secret key.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-1392

Related Identifiers

CVE-2026-45039

Affected Products

Rustfs

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-45039 · Security Note
• https://github.com/rustfs/rustfs/security/advisories/GHSA-r5qv-rc46-hv8q · Note
• https://twitter.com/CVEnew/status/2060091937688895756 · Twitter Post