CVE-2026-45041 RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery
Attackers can forge arbitrary license tokens using a hardcoded RSA private key, bypassing license enforcement in RustFS when the license feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45041?
CVE-2026-45041 is a high-severity vulnerability in rustfs, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named TEST_PRIVATE_KEY and uses it in production via parse_license() to "verify" license tokens. Because the key is embedded in every published source release and binary, anyone who can read the repository or extract it from the binary can mint arbitrary license tokens (any subject, any expiration). When the license Cargo feature is enabled, this defeats the entire license-enforcement mechanism. This vulnerability is fixed in 1.0.0-beta.2.
Weakness: CWE-321
Which versions are affected by CVE-2026-45041?
How do I fix CVE-2026-45041?
No fix has been published for CVE-2026-45041 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45041 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45041 exists.
Sources
Also known as GHSA-923g-jp7v-f97f.