RustFS EUVD-2026-32997

Exploitation requires two explicit, non-default conditions to be simultaneously true: first, the RustFS server process must be running with the RUST_LOG=debug environment variable set - this is not the default for production deployments and is typically used only during development, testing, or active incident troubleshooting; second, the CVSS vector PR:L confirms the attacker must hold a valid authenticated session with the RustFS server, ruling out unauthenticated remote exploitation. Additionally, the attacker must obtain read access to the server's log output, whether via direct host filesystem access, a log aggregation system (e.g., ELK, Splunk, Loki), or a misconfigured log endpoint. Deployments running RUST_LOG=info, RUST_LOG=warn, or with no RUST_LOG set are not affected by this vulnerability. The combination of the non-default debug configuration requirement and the authentication prerequisite substantially limits the realistic attacker population compared to what the AV:N network vector alone might suggest.

The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N reflects a medium-severity information disclosure issue. PR:L confirms an authentication requirement, meaningfully narrowing the attack surface compared to an unauthenticated flaw. VC:L (low confidentiality impact) may understate the practical consequence - exposed SecretAccessKeys and JWT tokens grant persistent access far beyond a single low-confidentiality read. No EPSS score was provided in the available intelligence data, so exploitation probability cannot be quantified. RustFS is not listed in the CISA KEV catalog, and no public exploit or proof-of-concept has been identified at time of analysis. Real-world risk is contingent on the non-default RUST_LOG=debug prerequisite: production deployments running at info-level or above are not exposed, but organizations that have historically used debug logging - or that run debug logging during incident response - may have already generated log files containing live credential material. The gap between the CVSS score and the practical credential exposure risk should be noted explicitly.

An attacker with a low-privilege authenticated account on a RustFS deployment running with RUST_LOG=debug triggers a series of API operations - object uploads, bucket listings, or authentication flows - that cause the server to emit JWT SessionTokens and SecretAccessKeys to its log output. The attacker then reads the log files directly from the host, via a misconfigured log shipper, or through a shared log aggregation platform, and extracts the plaintext credentials. With harvested SecretAccessKeys, the attacker can authenticate as higher-privileged identities, access additional storage buckets, or exfiltrate stored objects outside the attacker's original permission scope. No public proof-of-concept exploit has been identified, but the attack requires no specialized tooling beyond log file read access.