CVE-2026-45043

Katalog CVE

CVSS 9.3 · Critical EPSS 0,35%

Kerentanan Improper Privilege Management. Skor CVSS 4.0 9.3 (Critical) menurut github.com.

Deskripsi (NVD)

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access using a persistent, attacker-defined credential. This vulnerability is fixed in 1.0.0-beta.2.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

21 Juli 2026

Status NVD

Deferred

CVSS 4.0

9.3 (Critical), sumber github.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-284: Improper Access Control

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/rustfs/rustfs/security/advisories/GHSA-566f-q62r-wcr8