PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45044 rustfs CVE debrief

CVE-2026-45044 is a HIGH severity vulnerability (CVSS 8.8) in RustFS, a distributed object storage system built in Rust. The issue affects versions prior to 1.0.0-beta.2 and was published on 2026-05-28. The vulnerability stems from an authentication bypass in the admin router, where the `/profile/cpu` and `/profile/memory` endpoints are explicitly whitelisted from authentication checks. This allows unauthenticated HTTP clients to invoke CPU profiling handlers without credentials. On supported builds (e.g., glibc), the handler executes a fixed 60-second CPU profiling operation, which can lead to significant resource consumption and potential denial of service when abused. Additionally, the handler returns the server's absolute filesystem path in the response body, constituting information disclosure. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). A fix is available in version 1.0.0-beta.2.

Vendor
rustfs
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running RustFS distributed object storage systems prior to version 1.0.0-beta.2, particularly those with externally exposed administrative interfaces or deployments on glibc-based systems where the CPU profiling functionality is supported.

Technical summary

The RustFS admin router contains an explicit authentication whitelist for `/profile/cpu` and `/profile/memory` endpoints, permitting unauthenticated access to CPU and memory profiling handlers. The CPU profiling handler invokes `dump_cpu_pprof_for(Duration::from_secs(60))` on supported builds, creating a 60-second profiling window per request that can be exploited for resource exhaustion. The handler also leaks the server's absolute filesystem path in response bodies. The vulnerability is resolved in RustFS 1.0.0-beta.2.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade RustFS to version 1.0.0-beta.2 or later to remediate the authentication bypass and information disclosure vulnerabilities
  • Implement network-level access controls to restrict administrative endpoint exposure to trusted sources only
  • Monitor for anomalous CPU utilization patterns that may indicate exploitation attempts against profiling endpoints
  • Review application logs for unauthorized access attempts to `/profile/cpu` or `/profile/memory` endpoints
  • Assess whether absolute filesystem paths disclosed in profiling responses expose sensitive deployment information

Evidence notes

Vulnerability description confirms authentication bypass for profiling endpoints, fixed 60-second CPU profiling duration, and information disclosure of absolute filesystem paths. CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and high availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45044 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45044

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45044 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45044

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.