PT-2026-44825 · Rustfs · Rustfs

Mr-In4Inci3Le · Published 2026-05-29 · Updated 2026-06-02 · CVE-2026-45043

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions RustFS versions prior to 1.0.0-beta.2

Description Improper validation in the 'PUT /rustfs/admin/v3/import-iam' endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access through the use of a persistent, attacker-defined credential.

Recommendations Update to version 1.0.0-beta.2. As a temporary workaround, restrict access to the 'PUT /rustfs/admin/v3/import-iam' endpoint or limit the assignment of ImportIAMAction permissions.

Exploit

Fix

LPE

Improper Privilege Management

Improper Access Control

Weakness Enumeration

CWE-269

CWE-284

Related Identifiers

CVE-2026-45043

Affected Products

Rustfs

References · 5

• 🔥 https://github.com/rustfs/rustfs/security/advisories/GHSA-566f-q62r-wcr8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45043 · Security Note
• https://t.me/cveNotify/165572 · Telegram Post
• https://t.me/CVEtracker/55247 · Telegram Post
• https://twitter.com/CCBalert/status/2061422169758859331 · Twitter Post