Which versions of RustFS are affected by CVE-2026-45043?

RustFS distributed object storage versions before 1.0.0-beta.2 contain a critical privilege escalation flaw that allows low-privileged users to create permanent administrative service accounts,…. A patch is available.

How to fix or mitigate CVE-2026-45043?

24 hours: Audit all RustFS deployments to identify affected versions (< 1.0.0-beta.2) and assess exposure scope. 7 days: Apply vendor patch by upgrading all instances to RustFS version 1.0.0-beta.2 or later. 30 days: Audit service account creation and administrative action logs for the past 90 days; revoke unauthorized service accounts and rotate all administrative credentials.

RustFS CVE-2026-45043

Q: What is the CVSS score of CVE-2026-45043?

CVE-2026-45043 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33285 CRITICAL

Improper Privilege Management (CWE-269)

2026-05-29 GitHub_M

Privilege Escalation Rustfs

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:30 vuln.today

Patch available

May 29, 2026 - 14:01 EUVD

CVSS changed

May 29, 2026 - 13:22 NVD

9.3 (CRITICAL)

CVE Published

May 29, 2026 - 12:25 nvd

UNKNOWN (no severity yet)

DescriptionGitHub Advisory

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access using a persistent, attacker-defined credential. This vulnerability is fixed in 1.0.0-beta.2.

AnalysisAI

Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportIAMAction abuse the PUT /rustfs/admin/v3/import-iam endpoint to mint service accounts under arbitrary parent identities - including the root minioadmin user - granting full administrative control via attacker-chosen, persistent credentials. CVSS 4.0 scores this 9.3 (Critical) reflecting low attack complexity, low privileges, and high confidentiality/integrity impact with scope change. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided.

Technical ContextAI

RustFS is a Rust-implemented, S3-compatible distributed object storage system whose IAM model mirrors MinIO conventions (root user 'minioadmin', service accounts tied to parent identities, action-based policy grants like ImportIAMAction). The flaw sits in the admin import-IAM REST handler, which deserializes user-supplied JSON fields (parent, claims, accessKey, secretKey) and persists them as a service account without verifying that the requester is authorized to act on behalf of the named parent. This is a textbook CWE-269 (Improper Privilege Management) issue: the boundary check that should ensure a caller can only create accounts under identities they already own is missing, so possession of one narrow IAM permission collapses the entire trust hierarchy. The affected product is identified by CPE cpe:2.3:a:rustfs:rustfs across all versions prior to the fix.

RemediationAI

Vendor-released patch: 1.0.0-beta.2 - upgrade RustFS to 1.0.0-beta.2 or later as the primary fix, per the GHSA-566f-q62r-wcr8 advisory (https://github.com/rustfs/rustfs/security/advisories/GHSA-566f-q62r-wcr8). If immediate upgrade is not possible, revoke the ImportIAMAction permission from every non-root principal and audit existing IAM policies for grants of that action (trade-off: bulk IAM import workflows will break and must be performed by the root account). Additionally, block external access to the /rustfs/admin/v3/import-iam endpoint at the reverse proxy or network layer and restrict the admin API to a management VLAN or mTLS-protected interface (trade-off: legitimate remote administration tooling will need network-path or certificate updates). After patching, enumerate all service accounts whose parent is minioadmin or another privileged identity, validate provenance, and rotate or delete any unrecognized accessKey/secretKey pairs that may have been planted pre-patch.