CVE-2026-45043criticalCWE-269CWE-284

CVE-2026-45043: falha crítica em rustfs

RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rustfs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.2%
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access using a persistent, attacker-defined credential. This vulnerability is fixed in 1.0.0-beta.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Produtos afetados
rustfs · rustfs
CVEs relacionadas — rustfs

No mesmo produto, das mais perigosas para as menos.

CVE-2025-68926CRITICALRustFS has a gRPC Hardcoded Token Authentication BypassEPSS 31.9%CVE-2025-68705HIGHRustFS Path Traversal VulnerabilityEPSS 7.3%CVE-2026-27822CRITICALRust has Critical Stored XSS in Preview Modal, leading to Administrative Account TakeoverEPSS 5.1%CVE-2026-22782LOWRustFS RPC signature verification logs shared secretEPSS 0.5%CVE-2026-73284HIGHRustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service AccountsEPSS 0.5%CVE-2026-73285HIGHRustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untaggedEPSS 0.5%