CVE-2026-24762

high-risk

Published 2026-02-03

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret key, session token) to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be accessible to internal or external log consumers and could lead to compromise of sensitive credentials. This issue has been patched in version alpha.82.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Rustfs

Affected Vendors

Rustfs

References (1)

Vendor Advisory https://github.com/rustfs/rustfs/security/advisories/GHSA-r54g-49rx-98cr

/ 100

high-risk

Severity 26/34 · High

Exploitability 0/34 · Minimal

Exposure 28/34 · Critical