CVE-2026-45043
RustFS, a distributed object storage system written in Rust, has a critical flaw that lets attackers with ImportIAMAction create service accounts under any parent identity, including the root user. This allows them to gain full administrative access using attacker‑defined credentials. The issue is fixed in version 1.0.0‑beta.2.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
RustFS distributed object storage system, versions prior to 1.0.0‑beta.2, used by administrators who have ImportIAMAction privileges.
Real-world impact
An attacker could create privileged service accounts and gain full administrative control over the RustFS system, allowing them to read, modify, or delete all stored data and potentially disrupt service.
Why this severity
The CVSS score of 9.3 reflects the high impact of the vulnerability: it allows attackers to gain full administrative privileges (high confidentiality, integrity, availability impact) with low effort and no user interaction.
What to do about it
- 01Upgrade RustFS to version 1.0.0‑beta.2 or later.
- 02Restart the RustFS service.
NVD-referenced vendor advisory
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.