CVE-2026-45043: RustFS Privilege Escalation Vulnerability

CVE-2026-45043 Overview

CVE-2026-45043 is a privilege escalation vulnerability in RustFS, a distributed object storage system written in Rust. The flaw exists in the PUT /rustfs/admin/v3/import-iam endpoint, which fails to enforce privilege boundaries on attacker-supplied input. A user holding the ImportIAMAction permission can create service accounts under arbitrary parent identities, including the root minioadmin account. The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey fields without sanitization. The vulnerability is classified under [CWE-269] Improper Privilege Management. RustFS released a fix in version 1.0.0-beta.2.

Critical Impact
A low-privileged authenticated user can mint persistent root-equivalent credentials, achieving full administrative control over the object storage cluster.

Affected Products

RustFS distributed object storage system
All RustFS releases prior to 1.0.0-beta.2
Deployments exposing the /rustfs/admin/v3/import-iam administrative endpoint

Discovery Timeline

2026-05-29 - CVE-2026-45043 published to the National Vulnerability Database (NVD)
2026-06-02 - CVE-2026-45043 last updated in NVD database

Technical Details for CVE-2026-45043

Vulnerability Analysis

The vulnerability resides in the administrative Identity and Access Management (IAM) import handler exposed at PUT /rustfs/admin/v3/import-iam. The endpoint is intended to allow bulk import of IAM objects, but it omits authorization checks that bind the operation to the caller's privilege scope. An attacker authenticated with the ImportIAMAction permission can submit a crafted payload that defines a new service account whose parent field references the root user minioadmin or any other privileged identity. RustFS accepts the supplied accessKey, secretKey, and claims values verbatim and provisions a service account that inherits the parent's privileges. The result is a persistent credential pair controlled by the attacker that grants administrative access to the storage cluster.

Root Cause

The root cause is improper privilege management in the IAM import code path. The handler trusts client-supplied identity fields without validating that the caller is authorized to act on behalf of the specified parent. No sanitization or allow-list constrains the parent, claims, accessKey, or secretKey values. The privilege boundary between ImportIAMAction and root-level account creation is therefore not enforced.

Attack Vector

Exploitation requires network access to the RustFS admin API and a low-privileged account holding ImportIAMAction. The attacker issues a PUT request to /rustfs/admin/v3/import-iam with a JSON body declaring a service account whose parent is minioadmin and whose accessKey and secretKey are attacker-chosen. RustFS then writes the account into its IAM store. The attacker subsequently authenticates with the planted credentials and operates as root. Technical details are documented in the RustFS GHSA-566f-q62r-wcr8 advisory.

Detection Methods for CVE-2026-45043

Indicators of Compromise

Requests to PUT /rustfs/admin/v3/import-iam originating from non-administrative principals or unexpected source IP ranges.
Newly created service accounts whose parent field resolves to minioadmin or other privileged identities.
Access keys present in the IAM store that were not provisioned through standard administrative workflows.
Authentication events using access keys that immediately perform high-privilege actions such as bucket policy changes or user creation.

Detection Strategies

Audit RustFS access logs for any invocation of the import-iam endpoint and correlate against the calling identity's expected role.
Enumerate all service accounts and flag entries whose parent is the root user but were not created by an administrator.
Alert on creation of IAM principals where the accessKey does not match the platform's standard key-generation pattern, indicating an attacker-supplied value.

Monitoring Recommendations

Forward RustFS admin API logs to a centralized log platform and retain them for forensic review.
Establish a baseline of legitimate ImportIAMAction usage and alert on deviations.
Monitor for first-use of newly created access keys followed by sensitive administrative operations within a short time window.

How to Mitigate CVE-2026-45043

Immediate Actions Required

Upgrade RustFS to version 1.0.0-beta.2 or later, which enforces privilege boundaries on the import-iam endpoint.
Inventory all existing service accounts and revoke any whose parent is minioadmin or another privileged identity but were not created through an approved process.
Rotate the root minioadmin credential and any access keys that may have been exposed to untrusted callers of the admin API.
Restrict network exposure of the RustFS admin API to trusted management networks only.

Patch Information

The maintainers fixed CVE-2026-45043 in RustFS 1.0.0-beta.2. The patch enforces authorization on the PUT /rustfs/admin/v3/import-iam endpoint and prevents callers from assigning arbitrary parent identities or supplying unconstrained accessKey and secretKey values. Patch details are available in the GitHub Security Advisory GHSA-566f-q62r-wcr8.

Workarounds

Remove the ImportIAMAction permission from all non-administrative roles until the upgrade is applied.
Place a reverse proxy in front of RustFS that blocks requests to /rustfs/admin/v3/import-iam from untrusted principals.
Disable or firewall the admin API on internet-exposed deployments where bulk IAM import is not required.

bash

# Example: block the vulnerable endpoint at an NGINX reverse proxy
location = /rustfs/admin/v3/import-iam {
    return 403;
}