CVE-2026-45040 PUBLISHED

RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]

Assigner: GitHub_M
Reserved: 08.05.2026 Published: 28.05.2026 Updated: 28.05.2026

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server is run with RUST_LOG=debug sensitive credentials including SessionToken (JWT), SecretAccessKey, and full JWT claims are printed in plaintext to the server logs. This vulnerability is fixed in 1.0.0-beta.2.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	rustfs
Product	rustfs
Versions	Version < 1.0.0-beta.2 is affected

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-8cm2-h255-v749

Problem Types

CWE-312: Cleartext Storage of Sensitive Information CWE
CWE-532: Insertion of Sensitive Information into Log File CWE