What is the CVSS score of CVE-2026-45039?

CVE-2026-45039 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of RustFS are affected by CVE-2026-45039?

RustFS distributed object storage (versions prior to 1.0.0-beta.2) permits any networked attacker to bypass authentication and assume full administrative control of storage clusters without…. A patch is available.

How to fix or mitigate CVE-2026-45039?

Within 24 hours: Identify RustFS instances running versions prior to 1.0.0-beta.2; immediately restrict network access to trusted internal networks only; configure RUSTFS_RPC_SECRET environment variable to disable hardcoded credential fallback. Within 7 days: Verify RUSTFS_RPC_SECRET configuration across all instances; monitor vendor advisories for 1.0.0-beta.2 availability; evaluate alternative storage solutions if upgrade timeline exceeds risk tolerance. Within 30 days: Upgrade to RustFS 1.0.0-beta.2 or later if released, or execute migration to alternative distributed storage platform; decommission any unpatched instances.

RustFS CVE-2026-45039

EUVD-2026-32998 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-28 GitHub_M

Authentication Bypass Rustfs

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 28, 2026 - 20:02 EUVD

Analysis Generated

May 28, 2026 - 19:21 vuln.today

DescriptionGitHub Advisory

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, get_shared_secret() in crates/ecstore/src/rpc/http_auth.rs, falls back to the public, source-tree-embedded DEFAULT_SECRET_KEY = "rustfsadmin" when neither the RUSTFS_RPC_SECRET environment variable nor the global S3 secret key has been configured. This vulnerability is fixed in 1.0.0-beta.2.

AnalysisAI

Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remote attackers to forge valid internode RPC requests by exploiting a hardcoded fallback secret 'rustfsadmin' used when neither RUSTFS_RPC_SECRET nor the global S3 secret key is configured. With a CVSS of 9.8 and full CIA impact, this represents a critical pre-auth compromise vector against the storage cluster's internal trust boundary. No public exploit identified at time of analysis, though the fallback secret is publicly visible in the source tree, making weaponization trivial.

Technical ContextAI

RustFS is a Rust-implemented distributed object storage system providing an S3-compatible interface, where cluster nodes communicate over an internode RPC layer authenticated via HMAC-SHA256 signatures derived from a shared secret. The flaw resides in get_shared_secret() within crates/ecstore/src/rpc/http_auth.rs, which falls back to the constant DEFAULT_SECRET_KEY = 'rustfsadmin' embedded directly in the source tree when neither the RUSTFS_RPC_SECRET environment variable nor a global S3 secret key has been provisioned. This pattern aligns with CWE-798 (Use of Hard-coded Credentials): because the fallback value is publicly known to anyone who reads the open-source repository, the HMAC signature scheme collapses into a trivially forgeable authentication mechanism for any operator who did not explicitly configure a secret.

RemediationAI

Upgrade RustFS to 1.0.0-beta.2 or later, which removes the insecure fallback in get_shared_secret() - this is the vendor-released patch and the primary remediation, documented at https://github.com/rustfs/rustfs/security/advisories/GHSA-r5qv-rc46-hv8q. As an interim workaround for operators who cannot immediately upgrade, explicitly set the RUSTFS_RPC_SECRET environment variable (or configure a non-default global S3 secret key) to a strong random value on every node so the vulnerable fallback path is never taken; verify configuration by confirming that 'rustfsadmin' does not appear in any runtime secret material. Additionally, restrict network exposure of the internode RPC endpoints to a private management network or firewall them off from untrusted networks, accepting the side effect that this complicates multi-region or multi-tenant topologies that may rely on broader reachability.