Is CVE-2026-47136 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47136 being exploited in the wild.

How severe is CVE-2026-47136?

Informational severity, with a CVSS score of 6.9, published 28 May 2026.

Is there a fix for CVE-2026-47136?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47136 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47136?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47136: RustFS missing authentication in console license endpoint

CVE-2026-47136 · Severity: info · CVSS 6.9 · Published 2026-05-28

RustFS is a distributed object storage system used for managing large-scale data storage. A security flaw in the management console allows anyone with network access to view license details, such as the customer name and expiration date, without logging in. While this does not grant access to stored data, it exposes organizational information that could be used for reconnaissance or targeted attacks.

Quick answers

Is CVE-2026-47136 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47136 being exploited in the wild.
How severe is CVE-2026-47136?: Informational severity, with a CVSS score of 6.9, published 28 May 2026.
Which products and versions are affected?: RustFS RustFS <= 1.0.0-beta.1.
Is there a fix for CVE-2026-47136?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47136 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47136?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in the RustFS console listener. The 'GET /rustfs/console/license' endpoint, implemented in 'rustfs/src/admin/console.rs', fails to verify credentials before returning license metadata. An unauthenticated remote attacker can query this endpoint to obtain a JSON response containing the license subject and expiration timestamp. This information exposure (CWE-200) can be used to identify the organization owning the deployment and its license status. The issue is resolved in version 1.0.0-beta.2 by requiring administrative authentication for this endpoint.

Affected products

RustFS RustFS <= 1.0.0-beta.1

Timeline

2026-05-25: advisory: GitHub Security Advisory published
2026-05-28: disclosed: CVE published to NVD

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-xp32-gxq2-3v52

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.