CVE-2026-22782lowCWE-532

CVE-2026-22782: low-severity vulnerability in rustfs

RustFS RPC signature verification logs shared secret

Published

Follow this CVE+ Monitor rustfs+ Monitor rustfs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.9epss 0.5%
RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. This vulnerability is fixed in 1.0.0-alpha.80.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
rustfs · rustfs
Related CVEs — rustfs

In the same product, most dangerous first.

CVE-2025-68926CRITICALRustFS has a gRPC Hardcoded Token Authentication BypassEPSS 31.9%CVE-2025-68705HIGHRustFS Path Traversal VulnerabilityEPSS 7.3%CVE-2026-27822CRITICALRust has Critical Stored XSS in Preview Modal, leading to Administrative Account TakeoverEPSS 5.1%CVE-2026-73284HIGHRustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service AccountsEPSS 0.5%CVE-2026-73285HIGHRustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untaggedEPSS 0.5%CVE-2026-22042MEDIUMRustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege EscalationEPSS 0.4%