CVE-2026-45041: RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named TESTPRIVATEKEY and uses it in production via parselicense() to "verify" license tokens. Because the key is embedded in every published source release and binary, anyone who can read the repository or extract it from the binary can mint arbitrary license tokens (any subject, any expiration). When the license Cargo feature is enabled, this defeats the entire license-enforcement mechanism. This vulnerability is fixed in 1.0.0-beta.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-beta.2 - Configuration
Do not enable the 'license' Cargo feature when building or deploying RustFS; rebuild without the 'license' feature until you have upgraded to RustFS 1.0.0-beta.2, which fixes the embedded TEST_PRIVATE_KEY issue.
Cargo build (RustFS) license Cargo feature = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45041?
CVE-2026-45041 has a risk rating of 66, indicating a moderate severity vulnerability.
How do I fix CVE-2026-45041?
To mitigate CVE-2026-45041, upgrade to RustFS version 1.0.0-beta.2 or later where the hard-coded RSA private key has been removed.
What impact does CVE-2026-45041 have on RustFS?
CVE-2026-45041 allows for arbitrary license forgery due to the exposure of a hard-coded RSA private key in the license verifier.
Who is affected by CVE-2026-45041?
Any users of RustFS versions prior to 1.0.0-beta.2 are vulnerable to CVE-2026-45041.
What components are involved in CVE-2026-45041?
CVE-2026-45041 specifically involves the RustFS license verifier component and the hard-coded TEST_PRIVATE_KEY.