RustFS EUVD-2026-32998

Exploitation requires network reachability to a RustFS node's internode RPC interface on a deployment running a version prior to 1.0.0-beta.2 where neither the RUSTFS_RPC_SECRET environment variable nor a global S3 secret key has been configured, causing get_shared_secret() to return the hardcoded 'rustfsadmin' default. No authentication, user interaction, or non-default toggling is required beyond the operator's failure to set either secret - the vulnerable fallback is the out-of-the-box behavior. Exploitation is limited where operators have explicitly provisioned RUSTFS_RPC_SECRET or a global S3 key, or where the internode RPC port is isolated to a private network not reachable by the attacker.

The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H supports the 9.8 score - fully remote, low-complexity, no authentication, no user interaction, with high impact across confidentiality, integrity, and availability of the storage backend. EPSS, KEV status, and SSVC decision data were not provided in the input, so probabilistic exploitation prediction cannot be cited; however, the hardcoded secret is in plain text in a public GitHub repository, meaning exploit development requires no reverse engineering and the effective barrier to weaponization is near zero. Real-world risk is gated by deployment hygiene: clusters that explicitly set RUSTFS_RPC_SECRET or a global S3 key are not vulnerable, so the realistic blast radius depends on the prevalence of default-configuration RustFS deployments exposed on routable networks. No public exploit identified at time of analysis, but defenders should treat this as high-priority given the trivial conceptual exploit and the sensitivity of object storage workloads.

An attacker who can reach a RustFS node's internode RPC port over the network computes HMAC-SHA256 signatures using the publicly known 'rustfsadmin' string as the shared secret and issues forged RPC calls that the cluster accepts as authentic. From this position the attacker can manipulate stored objects, exfiltrate data, or disrupt cluster operations, achieving full confidentiality, integrity, and availability impact without prior credentials or user interaction.