Security Flaw in RustFS Distributed Object Storage System
CVE-2026-45041

8.7HIGH

Key Information:

Vendor

Rustfs

Status
Rustfs
Vendor
CVE Published:
28 May 2026

What is CVE-2026-45041?

RustFS, a distributed object storage system developed in Rust, contains a significant vulnerability where a 2048-bit RSA private key is embedded within its source code. This key, known as TEST_PRIVATE_KEY, is used in the production environment to verify license tokens via the parse_license() function. As a result, anyone with access to the repository or the compiled binary can potentially generate arbitrary license tokens that can bypass the intended license enforcement mechanisms. This flaw allows for extensive exploitation, especially when the license Cargo feature is activated. The issue was addressed in version 1.0.0-beta.2, highlighting the importance of secure key management in software development.

Affected Version(s)

rustfs < 1.0.0-beta.2

References

https://github.com/rustfs/rustfs/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.