RustFS up to 1.0.0-alpha.79 http_auth.rs log file

Summaryinfo

A vulnerability, which was classified as problematic, was found in RustFS up to 1.0.0-alpha.79. This affects an unknown function of the file crates/ecstore/src/rpc/http_auth.rs. Executing a manipulation can lead to log file. This vulnerability is tracked as CVE-2026-22782. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in RustFS up to 1.0.0-alpha.79. It has been declared as problematic. This vulnerability affects some unknown functionality of the file crates/ecstore/src/rpc/http_auth.rs. The manipulation with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. CVE summarizes:

RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. This vulnerability is fixed in 1.0.0-alpha.80.

The advisory is available at github.com. This vulnerability was named CVE-2026-22782 since 01/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading to version 1.0.0-alpha.80 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• RustFS

Version

• 1.0.0-alpha.0
• 1.0.0-alpha.1
• 1.0.0-alpha.2
• 1.0.0-alpha.3
• 1.0.0-alpha.4
• 1.0.0-alpha.5
• 1.0.0-alpha.6
• 1.0.0-alpha.7
• 1.0.0-alpha.8
• 1.0.0-alpha.9
• 1.0.0-alpha.10
• 1.0.0-alpha.11
• 1.0.0-alpha.12
• 1.0.0-alpha.13
• 1.0.0-alpha.14
• 1.0.0-alpha.15
• 1.0.0-alpha.16
• 1.0.0-alpha.17
• 1.0.0-alpha.18
• 1.0.0-alpha.19
• 1.0.0-alpha.20
• 1.0.0-alpha.21
• 1.0.0-alpha.22
• 1.0.0-alpha.23
• 1.0.0-alpha.24
• 1.0.0-alpha.25
• 1.0.0-alpha.26
• 1.0.0-alpha.27
• 1.0.0-alpha.28
• 1.0.0-alpha.29
• 1.0.0-alpha.30
• 1.0.0-alpha.31
• 1.0.0-alpha.32
• 1.0.0-alpha.33
• 1.0.0-alpha.34
• 1.0.0-alpha.35
• 1.0.0-alpha.36
• 1.0.0-alpha.37
• 1.0.0-alpha.38
• 1.0.0-alpha.39
• 1.0.0-alpha.40
• 1.0.0-alpha.41
• 1.0.0-alpha.42
• 1.0.0-alpha.43
• 1.0.0-alpha.44
• 1.0.0-alpha.45
• 1.0.0-alpha.46
• 1.0.0-alpha.47
• 1.0.0-alpha.48
• 1.0.0-alpha.49
• 1.0.0-alpha.50
• 1.0.0-alpha.51
• 1.0.0-alpha.52
• 1.0.0-alpha.53
• 1.0.0-alpha.54
• 1.0.0-alpha.55
• 1.0.0-alpha.56
• 1.0.0-alpha.57
• 1.0.0-alpha.58
• 1.0.0-alpha.59
• 1.0.0-alpha.60
• 1.0.0-alpha.61
• 1.0.0-alpha.62
• 1.0.0-alpha.63
• 1.0.0-alpha.64
• 1.0.0-alpha.65
• 1.0.0-alpha.66
• 1.0.0-alpha.67
• 1.0.0-alpha.68
• 1.0.0-alpha.69
• 1.0.0-alpha.70
• 1.0.0-alpha.71
• 1.0.0-alpha.72
• 1.0.0-alpha.73
• 1.0.0-alpha.74
• 1.0.0-alpha.75
• 1.0.0-alpha.76
• 1.0.0-alpha.77
• 1.0.0-alpha.78
• 1.0.0-alpha.79

Website

• Product: https://github.com/rustfs/rustfs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion