CVE-2026-45041: RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery

Synopsis

A hard-coded RSA private key vulnerability exists in RustFS, a distributed object storage system written in Rust. The private key is embedded directly in source code and compiled binaries, reachable by any unauthenticated party over the network who can read the public repository or extract the key from a released binary. Successful exploitation lets an attacker mint arbitrary license tokens with any subject or expiration, completely bypassing the license-enforcement mechanism. A fix was published in version 1.0.0-beta.2, and a patched-image rebuild at that version is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the RustFS service over the network; the embedded key is also readable from the public source repository without any special access.

• AuthenticationNot required

  No credentials are needed; the private key is publicly accessible in the open-source repository and in released binaries, so any party can retrieve it without authenticating.

• Victim interactionNot required

  The attacker forges license tokens independently and does not need any action from a user or operator of the affected system.

• Attack complexityDetail

  Exploitation is reliable and condition-free; extracting the key requires only reading source code or running a string-extraction tool against a released binary.

Blast Radius

• Attacker generates license tokens for any subject and any expiration date, granting themselves or others full access under forged licensing terms.
• The entire license-enforcement mechanism is rendered ineffective whenever the license Cargo feature is enabled, removing any access or entitlement controls it enforces.
• Operators lose the ability to audit or revoke license grants, because tokens signed with the publicly known key are indistinguishable from legitimately issued ones.