CVE-2026-45043: RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root

Synopsis

This is an authorization flaw in RustFS, a distributed object storage system written in Rust. The vulnerable PUT /rustfs/admin/v3/import-iam endpoint is reachable over the network and only requires an account with the ImportIAMAction permission; it fails to enforce privilege boundaries on the parent identity, accessKey, or secretKey fields supplied in the request. A successful attacker creates a persistent service account under the root user (minioadmin) with attacker-chosen credentials, yielding full administrative control over the object store. A patched-image rebuild at 1.0.0-beta.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the RustFS admin API over the network (AV:N).

• AuthenticationRequired

  A low-privilege account holding the ImportIAMAction permission is sufficient (PR:L); no admin credentials are needed.

• Victim interactionNot required

  No user has to click, approve, or open anything (UI:N); the attacker drives the request directly.

• Attack complexityDetail

  The exploit is reliable and condition-free (AC:L), requiring only a crafted JSON body to the import-iam endpoint.

Blast Radius

• Creates a persistent service account under the root user (minioadmin) with attacker-chosen accessKey and secretKey, granting full administrative control of the RustFS cluster.
• Reads any object stored in the system, including credentials, backups, and customer data held in the buckets.
• Writes, overwrites, or deletes stored objects and modifies IAM policies, enabling tampering with downstream applications that trust the bucket contents.
• Establishes a backdoor credential that survives password rotation of the legitimate root account, since the attacker controls a separate service-account secret.