CVE-2026-45044: RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers

Synopsis

Authentication bypass in RustFS allows any unauthenticated HTTP client to invoke CPU and memory profiling endpoints (/profile/cpu and /profile/memory) directly over the network. The admin router explicitly skips the authentication layer for these paths, so no credentials are required to reach them. Successful exploitation lets an attacker trigger a 60-second CPU-intensive profiling operation per request, causing denial of service, and also discloses the server's absolute filesystem path. No fix version has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The profiling endpoints are exposed over HTTP, so an attacker must be able to reach the RustFS admin service across the network.

• AuthenticationNot required

  The admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, so no credentials of any kind are needed.

• Victim interactionNot required

  The attacker sends HTTP requests directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free: any HTTP client that can reach the service can trigger the vulnerability without timing constraints or special environmental setup.

Blast Radius

• Repeated requests each trigger a fixed 60-second CPU profiling run, exhausting CPU resources and degrading or halting the RustFS service.
• The profiling response body returns the server's absolute filesystem path, giving an attacker layout information useful for follow-on attacks.
• Service availability is directly impacted: sustained abuse can push the node into a denial-of-service state affecting all object storage operations backed by that node.