PT-2026-6208 · Rustfs · Rustfs

Cchheang · Published 2026-02-03 · Updated 2026-02-24 · CVE-2026-24762

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RustFS versions alpha.13 through alpha.81

Description RustFS logs sensitive credential material, including access key, secret key, and session token, to application logs at the INFO level. This results in credentials being recorded in plaintext in log output, potentially accessible to internal or external log consumers, which could lead to compromise of sensitive credentials. The server writes newly generated STS credential information to logs, as demonstrated in log excerpts. An attacker or unauthorized internal user with access to logs could retrieve these credentials and use them to authenticate to RustFS services or perform other unauthorized actions. This issue is classified as an information disclosure issue.

Recommendations RustFS versions alpha.13 through alpha.81: Upgrade to version alpha.82 or later to resolve this issue. Do not include secrets in log output—redact secret key, session token, and similar fields. Log only safe identifiers such as non-sensitive IDs.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-24762

GHSA-R54G-49RX-98CR

Affected Products

Rustfs

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24762.json · Exploit
• https://github.com/rustfs/rustfs/security/advisories/GHSA-r54g-49rx-98cr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24762 · Security Note
• https://osv.dev/vulnerability/GHSA-r54g-49rx-98cr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24762 · Vendor Advisory
• https://github.com/rustfs/rustfs · Note
• https://twitter.com/Argus_pd/status/2026141761115222143 · Twitter Post
• https://twitter.com/Argus_pd/status/2026141740059824297 · Twitter Post