CVE-2026-45039: RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, getsharedsecret() in crates/ecstore/src/rpc/httpauth.rs, falls back to the public, source-tree-embedded DEFAULTSECRETKEY = "rustfsadmin" when neither the RUSTFSRPCSECRET environment variable nor the global S3 secret key has been configured. This vulnerability is fixed in 1.0.0-beta.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-beta.2 - Configuration
Configure a strong, non-default secret by setting the RUSTFS_RPC_SECRET environment variable or configuring the global S3 secret key so the get_shared_secret() function does not fall back to the embedded DEFAULT_SECRET_KEY = "rustfsadmin".
RustFS internode RPC authentication RUSTFS_RPC_SECRET / global S3 secret key = non-default secret (not "rustfsadmin")
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45039?
The severity of CVE-2026-45039 is critical with a score of 9.8.
How do I fix CVE-2026-45039?
To fix CVE-2026-45039, update RustFS to the latest version, ensuring that the shared secret is properly configured.
What exploitation impact does CVE-2026-45039 have?
CVE-2026-45039 allows peer impersonation due to the fallback to a public default credential.
Which version of RustFS is affected by CVE-2026-45039?
CVE-2026-45039 affects versions of RustFS prior to 1.0.0-beta.2.
What does the HMAC secret in CVE-2026-45039 protect?
The HMAC secret in CVE-2026-45039 is used to authenticate internode RPC requests within the RustFS system.