CVE-2026-45043: RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access using a persistent, attacker-defined credential. This vulnerability is fixed in 1.0.0-beta.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-beta.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45043?
CVE-2026-45043 has a critical severity rating of 9.3.
How do I fix CVE-2026-45043?
To fix CVE-2026-45043, upgrade to RustFS version 1.0.0-beta.2 or later.
What type of vulnerability is CVE-2026-45043?
CVE-2026-45043 is a vulnerability that allows the creation of backdoor service accounts.
Who is affected by CVE-2026-45043?
Users with ImportIAMAction permissions in RustFS versions prior to 1.0.0-beta.2 are affected by CVE-2026-45043.
What can an attacker do with CVE-2026-45043?
An attacker can create service accounts under arbitrary parent identities, including the root user, allowing unauthorized access.