CVE-2026-45043
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In RustFS prior to version 1.0.0-beta.2, a vulnerability exists in the PUT /rustfs/admin/v3/import-iam endpoint. Improper validation allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). An attacker can set their own credentials, leading to privilege escalation to full administrative access.
Risk Assessment
The organization is at risk of a complete takeover of the object storage system by an unauthorized user. An attacker can gain persistent administrative access, enabling theft, modification, or deletion of all data.
Recommendation
Immediately upgrade RustFS to version 1.0.0-beta.2 or later. If an upgrade is not possible, temporarily restrict access to the import-iam endpoint to trusted users only.
Original NVD description (English source)
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access using a persistent, attacker-defined credential. This vulnerability is fixed in 1.0.0-beta.2.