RustFS CVE-2026-47136

The attacker must be able to reach the RustFS console listener over the network - the console listener port must be accessible from the attacker's network position. No credentials are required (CVSS PR:N confirmed); any HTTP client suffices. The vulnerability is present on the console listener interface specifically; if the console listener is bound only to localhost or a restricted management network and not exposed to untrusted segments, exploitation from external or unprivileged internal positions is prevented. Exploitation is limited to read-only disclosure of license metadata (subject and expiration timestamp) - there is no path to credential theft, data exfiltration, or service disruption from this endpoint alone.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:N/VA:N confirms the attack is network-accessible, requires no authentication, no user interaction, and no special attack conditions - but confidentiality impact is explicitly rated Low, and integrity and availability are unaffected. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC has been reported, indicating no confirmed or widespread active exploitation at time of analysis. The practical operational impact is constrained by the sensitivity of the exposed data: license subject and expiration timestamp are software licensing metadata, not credentials, API keys, or user data. Organizations with commercially sensitive licensing arrangements may have heightened concern, but for most deployments this represents a low-priority informational exposure. SSVC signals: exploitation status is unproven; attack is automatable (trivial HTTP GET); technical impact is partial and narrow. This is not a high-operational-priority issue absent evidence of exploitation, but it should be patched in the normal patch cycle given the trivial fix availability.

An unauthenticated attacker on any network segment that can reach the RustFS console listener port issues a standard HTTP GET request to /rustfs/console/license using a common HTTP client such as curl. The server responds immediately with a JSON payload containing the license subject and expiration timestamp. No exploit toolkit, credential, or special protocol knowledge is required, making this trivially executable by anyone with network access to the console interface.