Executive Summary

CVE-2026-24762 is an information disclosure vulnerability in RustFS versions alpha.13 through alpha.81. The vulnerability occurs because RustFS logs sensitive credential material—such as access keys, secret keys, and session tokens—in plaintext at the INFO log level.

These credentials appear directly in application logs, making them accessible to anyone who can view the logs, including internal users or external parties with access to centralized logging systems.

This exposure can lead to compromise of sensitive credentials and unauthorized access to RustFS services.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to several impacts including:

• Compromise of sensitive credentials such as access keys, secret keys, and session tokens.
• Unauthorized authentication to RustFS services using stolen credentials.
• Session hijacking by attackers who gain access to session tokens.
• Insider threats from users who have access to the logs containing sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to violations of compliance standards such as PCI-DSS, SOC2, and ISO 27001 because these standards prohibit the exposure of authentication secrets in logs.

Logging sensitive credential material in plaintext can result in non-compliance with data protection and security requirements mandated by these regulations.

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by inspecting the application logs of RustFS versions alpha.13 through alpha.81 for the presence of sensitive credential material such as access keys, secret keys, and session tokens logged in plaintext at the INFO log level.'}, {'type': 'paragraph', 'content': "You can search the logs for keywords like 'access_key', 'secret_key', or 'session_token' to identify if sensitive credentials have been logged."}, {'type': 'list_item', 'content': "Use command-line tools such as grep to scan log files, for example: grep -iE 'access_key|secret_key|session_token' /path/to/rustfs/logs/*"}, {'type': 'list_item', 'content': 'Check centralized logging systems or log aggregators for entries containing these sensitive fields.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade RustFS to version alpha.82 or later, where the issue has been fixed by removing the logging of sensitive credential fields.

Until the upgrade can be performed, restrict access to application logs to only trusted personnel to minimize exposure of sensitive credentials.

Avoid sharing or distributing logs that may contain sensitive credential information.

Review and rotate any credentials that may have been exposed through the logs to prevent unauthorized access.

Useful 0 Not Useful 0