CVE-2026-45039: RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

Synopsis

This is an authentication bypass in RustFS, a distributed object storage system. The internode RPC layer uses a hardcoded default HMAC secret ("rustfsadmin") when no custom secret is configured, allowing any network-reachable attacker to forge valid HMAC-SHA256 signatures without credentials. Successful exploitation lets an attacker impersonate cluster peers and perform full reads, writes, and disruption of stored object data. No fix version has been published upstream yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the RustFS internode RPC service over the network; any host with TCP access to the service port can attempt the attack.

• AuthenticationNot required

  No credentials are needed because the attacker can independently compute a valid HMAC-SHA256 signature using the publicly known default secret "rustfsadmin".

• Victim interactionNot required

  The attack is fully remote and programmatic; no user action or social engineering is required.

• Attack complexityDetail

  Exploit complexity is low: the attacker only needs to know the hardcoded default secret, which is embedded in the public source tree, and no race conditions or special environmental factors are required.

Blast Radius

• An attacker impersonating a legitimate cluster peer can read any object stored across the RustFS cluster, exposing all stored data including credentials, backups, and application artifacts.
• An attacker can write or overwrite arbitrary objects within the cluster, corrupting or replacing stored data.
• An attacker can send malformed or destructive RPC calls to crash or destabilize cluster nodes, taking the storage service offline.
• All three impacts (confidentiality, integrity, availability) are reachable in a single session once the attacker begins issuing signed RPC requests with the known default secret.