CVE-2026-24762 RustFS Logs Sensitive Credentials in Plaintext

What is CVE-2026-24762?

CVE-2026-24762 is a medium-severity vulnerability in rustfs, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret key, session token) to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be accessible to internal or external log consumers and could lead to compromise of sensitive credentials. This issue has been patched in version alpha.82.

Weakness: CWE-532

Which versions are affected by CVE-2026-24762?

2 open source packages ship an affected version, including rustfs. It affects 1 product.

Products include Rustfs Rustfs.

How do I fix CVE-2026-24762?

Upgrade rustfs to 1.0.0-alpha.82 or later.

Is CVE-2026-24762 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24762 exists.

Other vulnerabilities in rustfs

• CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass Critical 9.8
• CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover Critical 9.1
• CVE-2025-68705 RustFS Path Traversal Vulnerability High 8.8
• CVE-2026-40937 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks High 8.3
• CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r54g-49rx-98cr.