CVE Explorer
CVE-2026-45041
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named TEST_PRIVATE_KEY and uses it in production via parse_license() to "verify" license tokens. Because the key is embedded in every published source release and binary, anyone who can read the repository or extract it from the binary can mint arbitrary license tokens (any subject, any expiration). When the license Cargo feature is
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"rustfs","vendor":"rustfs","versions":[{"status":"affected","version":"< 1.0.0-beta.2"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:c59adcf09c7babae11276ae5b8728b3e0ece8598e3527bcbc07db3d26702e7e5 · sha256:2993ff863225cdd9… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:c59adcf09c7babae11276ae5b8728b3e0ece8598e3527bcbc07db3d26702e7e5 · sha256:2993ff863225cdd9… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-321","description":"CWE-321: Use of Hard-coded Cryptographic Key","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:c59adcf09c7babae11276ae5b8728b3e0ece8598e3527bcbc07db3d26702e7e5 · sha256:2993ff863225cdd9… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"name":"https://github.com/rustfs/rustfs/security/advisories/GHSA-923g-jp7v-f97f","tags":["x_refsource_CONFIRM"],"url":"https://github.com/rustfs/rustfs/security/advisories/GHSA-923g-jp7v-f97f"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c59adcf09c7babae11276ae5b8728b3e0ece8598e3527bcbc07db3d26702e7e5 · sha256:2993ff863225cdd9… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/rustfs/rustfs/security/advisories/GHSA-923g-jp7v-f97f"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:c59adcf09c7babae11276ae5b8728b3e0ece8598e3527bcbc07db3d26702e7e5 · sha256:2993ff863225cdd9… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.