What is the CVSS score of CVE-2026-24762?

CVE-2026-24762 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Rustfs are affected by CVE-2026-24762?

Rustfs versions up to 1.0.0 are logging sensitive information to unencrypted log files, creating a data exposure risk if logs are accessed by unauthorized parties or stored insecurely.. A patch is available.

How to fix or mitigate CVE-2026-24762?

Within 24 hours: Identify all systems running Rustfs up to version 1.0.0 and classify data sensitivity of affected systems. Within 7 days: Implement compensating controls including log encryption, access restrictions to log files (file permissions 600/700), and centralized secure log aggregation with encryption in transit. Establish log retention policies to minimize exposure window. Within 30 days: Develop upgrade timeline for Rustfs once patches are released; contact vendor for ETA; consider alternative file system solutions if patch timeline is unacceptable for high-sensitivity systems.

Rustfs CVE-2026-24762

HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-02-03 security-advisories@github.com

GHSA-r54g-49rx-98cr

Information Disclosure Rustfs

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 16:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret key, session token) to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be accessible to internal or external log consumers and could lead to compromise of sensitive credentials. This issue has been patched in version alpha.82.

AnalysisAI

Rustfs versions up to 1.0.0 is affected by insertion of sensitive information into log file (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affects Rustfs. RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret key, session token) to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be accessible to internal or external log consumers and could lead to compromise of sensitive credentials. This issue has been patched in version alpha.82.