Executive brief
RustFS is a distributed object storage system used for managing large-scale data storage. A security flaw in the management console allows anyone with network access to view license details, such as the customer name and expiration date, without logging in. While this does not grant access to stored data, it exposes organizational information that could be used for reconnaissance or targeted attacks.
Technical details
A missing authentication vulnerability (CWE-306) exists in the RustFS console listener. The 'GET /rustfs/console/license' endpoint, implemented in 'rustfs/src/admin/console.rs', fails to verify credentials before returning license metadata. An unauthenticated remote attacker can query this endpoint to obtain a JSON response containing the license subject and expiration timestamp. This information exposure (CWE-200) can be used to identify the organization owning the deployment and its license status. The issue is resolved in version 1.0.0-beta.2 by requiring administrative authentication for this endpoint.
Affected products
- RustFS RustFS <= 1.0.0-beta.1
Timeline
- 2026-05-25: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: CVE published to NVD