CVE-2026-24762: RustFS Information Disclosure Vulnerability

CVE-2026-24762 Overview

RustFS, a distributed object storage system built in Rust, contains an information disclosure vulnerability that results in sensitive credential material being logged in plaintext. From versions alpha.13 to alpha.81, RustFS logs access keys, secret keys, and session tokens to application logs at INFO level. This behavior exposes credentials to anyone with access to log files, including internal log consumers, centralized logging systems, or external attackers who gain access to log storage.

Critical Impact

Sensitive authentication credentials (access key, secret key, session token) are written to application logs in plaintext, potentially allowing unauthorized access to object storage resources if logs are compromised.

Affected Products

• RustFS versions alpha.13 through alpha.81

Discovery Timeline

• 2026-02-03 - CVE CVE-2026-24762 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-24762

Vulnerability Analysis

This vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File). The core issue stems from RustFS logging authentication credentials at the INFO log level without proper sanitization or redaction. When the application processes requests or initializes storage connections, it inadvertently writes sensitive credential material—including access keys, secret keys, and session tokens—directly to the application's log output.

The exposure of credentials through logging creates a significant attack surface. Application logs are often stored in multiple locations, forwarded to centralized logging infrastructure, retained for extended periods, and accessed by various personnel for debugging and monitoring purposes. Any of these access points could lead to credential theft if logs contain plaintext authentication material.

Root Cause

The root cause is improper handling of sensitive data during logging operations. The RustFS codebase logs credential-containing objects or structures at INFO level without implementing proper redaction mechanisms. This is a common anti-pattern where debug or operational logging includes more information than necessary, inadvertently capturing secrets that should never be written to persistent storage.

Attack Vector

An attacker can exploit this vulnerability through network-based access to log storage systems. The attack vector involves:

1. Gaining access to application logs through legitimate means (internal employee, contractor) or through compromise of log aggregation systems
2. Searching logs for credential patterns such as access keys and session tokens
3. Using extracted credentials to authenticate to the RustFS storage system
4. Accessing, modifying, or exfiltrating stored objects with the compromised credentials

Since no exploits are publicly available and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, the primary concern is insider threat or secondary exploitation following a breach of logging infrastructure.

The vulnerability does not require any authentication or user interaction to trigger—simply running RustFS in the affected version range causes credentials to be logged during normal operations.

Detection Methods for CVE-2026-24762

Indicators of Compromise

• Presence of access keys, secret keys, or session tokens in RustFS application log files
• Unusual access patterns to log files or log aggregation systems from unexpected sources
• Evidence of credential extraction tools or grep patterns targeting authentication strings in logs
• Unauthorized API calls to RustFS using credentials that should not be externally known

Detection Strategies

• Implement log scanning rules to detect credential patterns (AWS-style access keys, base64-encoded tokens) in log output
• Monitor for anomalous access to log storage systems or unusual bulk log retrieval activities
• Deploy secret detection tools in CI/CD pipelines and log aggregation systems to alert on exposed credentials
• Audit RustFS version deployments to identify systems running vulnerable versions alpha.13 through alpha.81

Monitoring Recommendations

• Enable audit logging for access to log files and log management systems
• Configure alerts for any access key or session token patterns detected in log streams
• Monitor RustFS API authentication logs for usage of credentials that may have been exposed
• Implement log retention policies that minimize the window of credential exposure

How to Mitigate CVE-2026-24762

Immediate Actions Required

• Upgrade RustFS to version alpha.82 or later, which contains the security patch
• Rotate all access keys, secret keys, and session tokens that may have been logged while running vulnerable versions
• Audit and purge historical logs that may contain exposed credentials
• Review access controls on log storage and aggregation systems

Patch Information

The vulnerability has been patched in RustFS version alpha.82. The fix prevents sensitive credential material from being logged at any log level. Organizations should upgrade to alpha.82 or later as soon as possible. For additional details, refer to the GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, reduce log verbosity to exclude INFO level messages (note: this may impact operational visibility)
• Implement log filtering at the aggregation layer to redact credential patterns before storage
• Restrict access to application logs to only essential personnel
• Consider disabling centralized log forwarding for RustFS until the upgrade is complete

# After upgrading to alpha.82, rotate existing credentials
# Example: Regenerate access credentials via RustFS CLI
rustfs-admin credentials rotate --all

# Purge logs containing potential credential exposure
# Adjust path and retention as appropriate for your environment
find /var/log/rustfs/ -name "*.log" -mtime +0 -exec shred -u {} \;