Executive brief
RustFS is a distributed storage system used to manage large-scale data across multiple servers. A security flaw allows attackers to bypass authentication by using a publicly known default password ("rustfsadmin") that the system automatically uses if not explicitly configured otherwise. This allows an unauthorized person to impersonate a legitimate server in the cluster, potentially leading to the theft, modification, or deletion of stored data.
Technical details
RustFS prior to version 1.0.0-beta.2 contains a hard-coded credentials vulnerability (CWE-798/CWE-1392) in its internode RPC layer. The 'get_shared_secret()' function in 'crates/ecstore/src/rpc/http_auth.rs' falls back to a static, source-tree-embedded string ('rustfsadmin') if the 'RUSTFS_RPC_SECRET' environment variable or global S3 secret key is not set. An unauthenticated attacker with network access to the RPC port (typically 7000) can generate valid HMAC-SHA256 signatures using this default key to impersonate a cluster node. This allows the execution of arbitrary RPC commands, bypassing S3-layer access controls and enabling full data exfiltration or manipulation. The issue is fixed in version 1.0.0-beta.2 by removing the fallback mechanism.
Affected products
- RustFS RustFS Prior to 1.0.0-beta.2
Timeline
- 2026-05-09: advisory: GitHub Security Advisory GHSA-r5qv-rc46-hv8q published
- 2026-05-28: disclosed: CVE-2026-45039 published to NVD