CVE-2026-45044: RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, allowing any unauthenticated HTTP client to invoke profiling handlers without credentials. On supported builds (e.g., glibc), the handler invokes a fixed 60-second CPU profiling operation (dumpcpupproffor(Duration::fromsecs(60))). This may result in significant CPU resource consumption per request and can potentially lead to denial of service when abused. Additionally, the handler returns the server’s absolute filesystem path in the response body, resulting in information disclosure. This vulnerability is fixed in 1.0.0-beta.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RustFSto a version that resolves this vulnerability.Fixed in 1.0.0-beta.2 - Configuration
Remove /profile/cpu and /profile/memory from the admin router's authentication whitelist so these endpoints are subject to normal authentication checks (do not allow unauthenticated access to profiling handlers).
admin router authentication whitelist = remove /profile/cpu and /profile/memory from whitelist - Compensating control
Until the application is upgraded, restrict access to the /profile/* endpoints at the network edge (firewall, WAF, or reverse proxy) to trusted administrative IPs or block them entirely to prevent unauthenticated access and abuse.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45044?
CVE-2026-45044 has a risk rating of 52, indicating a moderate severity level.
What kind of vulnerability is CVE-2026-45044?
CVE-2026-45044 is an authentication bypass vulnerability that allows unauthenticated access to profiling handlers in RustFS.
How do I fix CVE-2026-45044?
To fix CVE-2026-45044, users should upgrade to versions of RustFS later than 1.0.0-beta.2 where this vulnerability has been addressed.
What can attackers do with CVE-2026-45044?
Attackers can exploit CVE-2026-45044 to access profiling information without authentication, potentially leading to further attacks.
Is CVE-2026-45044 present in all versions of RustFS?
CVE-2026-45044 is present in all versions prior to 1.0.0-beta.2 of RustFS.