Executive brief
RustFS, a distributed storage system, contains a security flaw where administrative profiling tools are accessible without a password. An attacker can remotely trigger intensive 60-second CPU diagnostic tasks, which can overwhelm the server and cause a service outage. Additionally, the system reveals its internal folder structure to anyone who accesses these tools, providing information that could be used for further attacks.
Technical details
A missing authentication check (CWE-306) in 'rustfs/src/admin/router.rs' explicitly whitelists the '/profile/cpu' and '/profile/memory' endpoints from the authentication layer. On glibc-based systems, invoking the CPU profiling handler triggers a fixed 60-second profiling operation via 'dump_cpu_pprof_for', which can be abused by unauthenticated network attackers to cause a Denial of Service (DoS) through CPU exhaustion. Furthermore, the handler in 'rustfs/src/admin/handlers/profile.rs' returns the server's absolute filesystem path in the HTTP response body, leading to information disclosure. The vulnerability is confirmed to bypass 401/403 checks even on builds where the profiling fails (returning 500 instead). The issue is resolved in version 1.0.0-beta.2.
Affected products
- RustFS RustFS < 1.0.0-beta.2
Timeline
- 2026-05-09: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: CVE published to NVD