# CVE-2026-45039: RustFS hard-coded default HMAC secret in internode RPC layer

Source: https://junglewise.ai/threats/cve-2026-45039-rustfs-hard-coded-default-hmac-secret-in-internode-rpc-layer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-45039 · Severity: critical · CVSS 9.8 · Published 2026-05-28

RustFS is a distributed storage system used to manage large-scale data across multiple servers. A security flaw allows attackers to bypass authentication by using a publicly known default password ("rustfsadmin") that the system automatically uses if not explicitly configured otherwise. This allows an unauthorized person to impersonate a legitimate server in the cluster, potentially leading to the theft, modification, or deletion of stored data.

## Quick answers

**Is CVE-2026-45039 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45039 being exploited in the wild.

**How severe is CVE-2026-45039?** Critical severity, with a CVSS score of 9.8, published 28 May 2026.

**Which products and versions are affected?** RustFS RustFS Prior to 1.0.0-beta.2.

**Is there a fix for CVE-2026-45039?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45039 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45039?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

RustFS prior to version 1.0.0-beta.2 contains a hard-coded credentials vulnerability (CWE-798/CWE-1392) in its internode RPC layer. The 'get_shared_secret()' function in 'crates/ecstore/src/rpc/http_auth.rs' falls back to a static, source-tree-embedded string ('rustfsadmin') if the 'RUSTFS_RPC_SECRET' environment variable or global S3 secret key is not set. An unauthenticated attacker with network access to the RPC port (typically 7000) can generate valid HMAC-SHA256 signatures using this default key to impersonate a cluster node. This allows the execution of arbitrary RPC commands, bypassing S3-layer access controls and enabling full data exfiltration or manipulation. The issue is fixed in version 1.0.0-beta.2 by removing the fallback mechanism.

## Affected products

- RustFS RustFS Prior to 1.0.0-beta.2

## Timeline

- 2026-05-09: advisory: GitHub Security Advisory GHSA-r5qv-rc46-hv8q published
- 2026-05-28: disclosed: CVE-2026-45039 published to NVD

## References

- [https://github.com/rustfs/rustfs/security/advisories/GHSA-r5qv-rc46-hv8q](https://github.com/rustfs/rustfs/security/advisories/GHSA-r5qv-rc46-hv8q)