CVE-2026-45043: Rustfs

Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days.

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access using a persistent, attacker-defined credential. This vulnerability is fixed in 1.0.0-beta.2.

Affected products

• Rustfs Rustfs: before 1.0.0-beta.2 (fixed in 1.0.0-beta.2)

Published 2026-05-29. Last modified 2026-07-21.