What is the CVSS score of CVE-2026-22782?

CVE-2026-22782 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Rustfs are affected by CVE-2026-22782?

Organizations using RustFS face notable risk from CVE-2026-22782, a log file exposure vulnerability rated CVSS 7.5.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22782?

Yes, a public proof-of-concept exploit is available for CVE-2026-22782. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-22782?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Rustfs CVE-2026-22782

HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-01-16 security-advisories@github.com

GHSA-333v-68xh-8mmq

Information Disclosure Rustfs

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 09, 2026 - 20:47 vuln.today

Public exploit code

Patch released

Feb 09, 2026 - 20:47 nvd

Patch available

CVE Published

Jan 16, 2026 - 17:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. This vulnerability is fixed in 1.0.0-alpha.80.

AnalysisAI

RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invalidly signed RPC requests, allowing attackers with log access to obtain authentication credentials and forge RPC calls. The vulnerability stems from improper error handling in the HTTP authentication module that logs sensitive cryptographic material. Public exploit code exists for this high-severity flaw, which is remediated in version 1.0.0-alpha.80.

Technical ContextAI

This vulnerability (CWE-532: Insertion of Sensitive Information into Log File) exists in the request component. RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path.