CVE-2026-45040: RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server is run with RUSTLOG=debug sensitive credentials including SessionToken (JWT), SecretAccessKey, and full JWT claims are printed in plaintext to the server logs. This vulnerability is fixed in 1.0.0-beta.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-beta.2 - Configuration
Do not run the server with RUST_LOG=debug because debug logging prints SessionToken (JWT), SecretAccessKey, and full JWT claims to logs. Set RUST_LOG to a less verbose level such as 'info' or 'warn'.
RustFS server RUST_LOG = not 'debug' (e.g., 'info' or 'warn') - Operational
Assume sensitive credentials may have been exposed if the server was run with RUST_LOG=debug. Rotate/replace any SessionToken (JWT), SecretAccessKey, and other affected credentials, invalidate exposed JWTs/sessions, and review logs for instances of leaked secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45040?
The severity of CVE-2026-45040 is rated at 50, indicating a moderate risk due to sensitive information leakage.
How do I fix CVE-2026-45040?
To fix CVE-2026-45040, upgrade RustFS to version 1.0.0-beta.2 or later to prevent sensitive information from being logged.
What type of information is leaked in CVE-2026-45040?
CVE-2026-45040 leads to the leakage of sensitive credentials such as SessionToken, SecretAccessKey, and full JWT claims in debug logs.
How does CVE-2026-45040 affect RustFS users?
Users of RustFS running the server in debug mode may inadvertently expose critical sensitive information through log outputs.
In what mode does CVE-2026-45040 become a risk?
CVE-2026-45040 becomes a risk when RustFS is configured to run with RUST_LOG set to debug.