What’s Vulnerable › Vulnerabilities

CVE-2026-22782: RustFS RPC signature verification logs shared secret

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-16 · updated 2026-06-17
• Weakness: CWE-532

Description

RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. This vulnerability is fixed in 1.0.0-alpha.80.

Affected products

• rustfs: 1.0.0-alpha1, 1.0.0-alpha10, 1.0.0-alpha11, 1.0.0-alpha12, 1.0.0-alpha13, 1.0.0-alpha14 (+73)

References

• https://github.com/rustfs/rustfs/blob/9e162b6e9ebb874cc1d06a7b33bc4a05786578aa/crates/ecstore/src/rpc/http_auth.rs#L115-L122
• https://github.com/rustfs/rustfs/commit/6b2eebee1d07399ef02c0863bd515b4412a5a560
• https://github.com/rustfs/rustfs/security/advisories/GHSA-333v-68xh-8mmq

Get alerted when CVE-2026-22782 or the next vulnerability affects your stack