Privilege Escalation in RustFS Distributed Object Storage System
CVE-2026-45043

9.3CRITICAL

Key Information:

Vendor

Rustfs

Status
Rustfs
Vendor
CVE Published:
29 May 2026

What is CVE-2026-45043?

RustFS, a distributed object storage system, has a vulnerability prior to version 1.0.0-beta.2 due to insufficient validation in the PUT /rustfs/admin/v3/import-iam endpoint. This flaw allows a user with ImportIAMAction privileges to create service accounts under any parent identity, including the root user. Importantly, the endpoint accepts attacker-controlled parameters, like parent, claims, accessKey, and secretKey, without enforcing necessary privilege boundaries or input sanitization. Such behavior leads to potential privilege escalation, enabling attackers to gain full administrative access using custom, persistent credentials. This serious flaw has been rectified in version 1.0.0-beta.2.

Affected Version(s)

rustfs < 1.0.0-beta.2

References

https://github.com/rustfs/rustfs/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.