CVE-2026-22782 RustFS RPC signature verification logs shared secret
RustFS logs shared HMAC secrets on invalid RPC signatures, allowing log readers to forge RPC calls and bypass authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22782?
CVE-2026-22782 is a low-severity vulnerability in rustfs, published on 16 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls. In crates/ecstore/src/rpc/http_auth.rs, the invalid signature branch logs sensitive data. This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers. This vulnerability is fixed in 1.0.0-alpha.80.
Weakness: CWE-532
Which versions are affected by CVE-2026-22782?
2 open source packages ship an affected version, including rustfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rustfs crates.io | From 1.0.0-alpha.1 | 1.0.0-alpha.80 |
rustfs crates.io | From 1.0.0-alpha.1 | 1.0.0-alpha.80 |
Products include Rustfs Rustfs.
How do I fix CVE-2026-22782?
Upgrade rustfs to 1.0.0-alpha.80 or later.
Is CVE-2026-22782 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22782 exists.
Other vulnerabilities in rustfs
- CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass
- CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
- CVE-2025-68705 RustFS Path Traversal Vulnerability
- CVE-2026-40937 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
- CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write
Sources
Also known as GHSA-333v-68xh-8mmq.