Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-45043: RustFS can let attackers create admin service accounts

CVE-2026-45043 · published 5 months ago

Summary

Versions of RustFS before 1.0.0‑beta.2 let a user who can call the import‑IAM function create new service accounts under any existing account, even the top‑level admin account. This gives the attacker full control of the storage system with a credential they choose. Update RustFS to version 1.0.0‑beta.2 or later to stop this behavior.

Original advisory text

RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper validation in the PUT /rustfs/admin/v3/import-iam endpoint allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). The endpoint accepts attacker-controlled parent, claims, accessKey, and secretKey values without enforcing privilege boundaries or sanitization. This enables privilege escalation to full administrative access using a persistent, attacker-defined credential. This vulnerability is fixed in 1.0.0-beta.2.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45043... Vendor Advisory
https://github.com/rustfs/rustfs/security/advisories/GHSA-566f-q62r-wcr8 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-45043 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-269Improper Privilege Management

CWE-284Improper Access Control

Timeline

Published29 May 2026

Updated4 Nov 2026

First seen29 May 2026

Sources

CVE-2026-45043 · OSV

CVE-2026-45043 · NVD

GHSA-566f-q62r-wcr8 · GHSA

Track software like this

Free during beta