EUVD-2026-32996Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessClone RustFS public repo
-
DeliveryExtract TEST_PRIVATE_KEY from token.rs
-
ExploitForge RSA-signed license token
-
ExecutionSubmit token to licensed RustFS instance
-
ImpactBypass license enforcement
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Key management, no hard-coded keys
|
| Exploitation Conditions | Exploitation requires the target RustFS binary to be built with the |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N rates this 8.7 with high integrity impact (VI:H) and no confidentiality or availability impact, which fits a license-forgery scenario rather than data theft or service disruption. EPSS and KEV data were not provided; the vulnerability is not listed in CISA KEV at time of analysis and no public exploit code is identified, though weaponization is trivial since the private key is directly readable in the source tree - anyone with |
| Exploit ScenarioDerived | An attacker clones the public RustFS repository, extracts the TEST_PRIVATE_KEY constant from crates/appauth/src/token.rs, and uses any standard JWT/RSA tooling to sign a license token with an arbitrary subject (e.g., 'enterprise-customer') and a far-future expiration. They then present this token to a RustFS instance built with the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
License-enforcement bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) stems from a hardcoded 2048-bit RSA private key (TEST_PRIVATE_KEY) shipped in crates/appauth/src/token.rs and used in production by parse_license() to verify license tokens. Any attacker who can read the public repository or extract the key from a compiled binary can mint arbitrary license tokens with any subject and expiration, defeating the license feature entirely. No public exploit identified at time of analysis, though the key material is trivially recoverable from the open-source code.
RemediationAI
Vendor-released patch: upgrade to RustFS 1.0.0-beta.2 or later, which removes the hardcoded TEST_PRIVATE_KEY from production code paths; see https://github.com/rustfs/rustfs/security/advisories/GHSA-923g-jp7v-f97f for advisory details. As a compensating control until the upgrade is applied, build RustFS without the license Cargo feature, which removes the parse_license() code path entirely (trade-off: any commercial features gated behind licensing become unavailable), or rotate to an out-of-band license-verification mechanism using a private key held only by the vendor. Operators should also audit any previously issued license tokens, since forged tokens are cryptographically indistinguishable from legitimate ones and cannot be detected retroactively without rekeying.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RustFS is a Rust-based distributed object storage system (S3-compatible) whose optional 'license' Cargo feature gates commercial functionality behind signed license tokens. The vulnerability sits in the appauth crate, where parse_license() validates tokens using an RSA-2048 keypair whose private half is embedded as a string constant intended for tests but reused in production builds. This is a textbook CWE-321 (Use of Hard-coded Cryptographic Key) issue - asymmetric signing only provides security when the private key is held by the signer alone, but here every consumer of the source or binary holds both halves, collapsing the trust model to symmetric-key-with-public-secret. The affected CPE is cpe:2.3:a:rustfs:rustfs covering all versions up to 1.0.0-beta.2.
Know when Rustfs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named TEST_PRIVATE_KEY and uses it in production via parse_license() to "verify" license tokens. Because the key is embedded in every published source release and binary, anyone who can read the repository or extract it from the binary can mint arbitrary license tokens (any subject, any expiration). When the license Cargo feature is enabled, this defeats the entire license-enforcement mechanism. This vulnerability is fixed in 1.0.0-beta.2.
Executive ViewAI
RustFS distributed object storage versions prior to 1.0.0-beta.2 expose a security key in their public source code that completely disables license enforcement. Attackers can use this key to generate unauthorized license tokens with any permissions and expiration dates, bypassing all license-based access controls. Organizations relying on RustFS licensing for access control face immediate risk of unauthorized service usage and potential data exposure.
Implement network segmentation to restrict RustFS access from untrusted networks; enforce application-level authentication and authorization independent of RustFS license checks; enable comprehensive audit logging for license token generation and validation; restrict administrative and physical access to systems running vulnerable RustFS instances.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
RustFS (alpha.13 to alpha.78) has a privilege escalation where restricted service accounts can self-issue unrestricted c
Stored XSS in RustFS distributed object storage system before 1.0.0-alpha.83. Malicious JavaScript persists in stored ob
Incorrect IAM permission validation in RustFS prior to version 1.0.0-alpha.79 permits principals with export-only permis
Path traversal in the RustFS /rustfs/rpc/read_file_stream endpoint allows an attacker to read arbitrary files from the h
RustFS versions 1.0.0-alpha.1 through 1.0.0-alpha.79 expose the shared HMAC secret in server logs when processing invali
Authentication bypass in RustFS distributed object storage (versions prior to 1.0.0-beta.2) allows unauthenticated remot
RustFS is a distributed object storage system built in Rust. [CVSS 4.0 MEDIUM]
Privilege escalation in RustFS distributed object storage before 1.0.0-beta.2 lets a low-privileged user holding ImportI
Stored cross-site scripting in RustFS Console (0.1.7 through 0.1.9) lets an attacker upload an HTML payload disguised as
Privilege escalation in RustFS prior to version 1.0.0-beta.11 allows any authenticated user holding CreateServiceAccount
Unauthenticated denial of service and information disclosure in RustFS distributed object storage prior to version 1.0.0
Cross-tenant object injection in RustFS 1.0.0-beta.4 lets a tenant holding only PutObject rights on their own bucket wri
Exploit-DB