PT-2026-44474 · Rustfs · Rustfs

Michael Graff + 1 · CVE-2026-47136 · Published 2026-05-28 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.2

Description The console endpoint "GET /rustfs/console/license" returns parsed license metadata, including the license subject and expiration timestamp in JSON format, without requiring authentication. Any client capable of reaching the console listener can query this endpoint without providing credentials.

Recommendations Update to version 1.0.0-beta.2.

Exploit

Fix

Information Disclosure

Missing Authentication

Weakness Enumeration

CWE-200

CWE-306

Related Identifiers

CVE-2026-47136

GHSA-XP32-GXQ2-3V52

Affected Products

Rustfs

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47136.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47136 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47136 · Vendor Advisory
• https://github.com/rustfs/rustfs/security/advisories/GHSA-xp32-gxq2-3v52 · Note
• https://twitter.com/CVEnew/status/2060091943556723082 · Twitter Post