PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45041 rustfs CVE debrief

A critical cryptographic vulnerability in RustFS distributed object storage allows complete license enforcement bypass. The application embeds a hardcoded 2048-bit RSA private key as a string constant (TEST_PRIVATE_KEY) in crates/appauth/src/token.rs, which is used in production via parse_license() to verify license tokens. Because this key is present in all published source releases and binaries, any party with repository access or binary extraction capability can forge arbitrary license tokens with any subject and expiration date. When the license Cargo feature is enabled, this completely defeats the license-enforcement mechanism. The vulnerability stems from CWE-321: Use of Hard-coded Cryptographic Key. Organizations using RustFS with license enforcement enabled should upgrade to version 1.0.0-beta.2 immediately.

Vendor
rustfs
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running RustFS distributed object storage with license enforcement enabled; software supply chain security teams; Rust developers embedding cryptographic verification in applications

Technical summary

RustFS versions prior to 1.0.0-beta.2 contain a hardcoded 2048-bit RSA private key (TEST_PRIVATE_KEY) in crates/appauth/src/token.rs. This key is used by the parse_license() function for production license token verification when the license Cargo feature is enabled. The embedded key allows any party with source or binary access to cryptographically forge valid license tokens, completely bypassing license enforcement. The vulnerability is classified as CWE-321 and carries a CVSS 4.0 score of 8.7 (HIGH severity).

Defensive priority

critical

Recommended defensive actions

  • Upgrade RustFS to version 1.0.0-beta.2 or later immediately
  • Audit all deployed RustFS instances for unauthorized license tokens
  • Review license enforcement logs for anomalies predating the fix
  • If immediate upgrade is not possible, consider disabling the license Cargo feature until patching is complete
  • Verify integrity of license tokens in use by cross-referencing against expected issuance patterns
  • Implement monitoring for unexpected license validation patterns

Evidence notes

CVE published 2026-05-28. Advisory confirms hardcoded RSA private key in TEST_PRIVATE_KEY constant used for production license verification. Fixed in 1.0.0-beta.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45041 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45041

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45041 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45041

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.