CVE-2026-47136 - RustFS: Unauthenticated RustFS console license endpoint exposes license metadata

Back Back to CVE browser

MEDIUM

RustFS: Unauthenticated RustFS console license endpoint exposes license metadata

Published May 28, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.54%

Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed license metadata without requiring authentication. The endpoint is registered on the console listener and returns JSON containing license information such as the license subject and expiration timestamp. Any client that can reach the console listener can query this endpoint without credentials. This vulnerability is fixed in 1.0.0-beta.2.

Affected products

Vendor Rustfs Product Rustfs Default
n/a
- Version
  < 1.0.0-beta.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rustfs

n/a

Version	Status	Constraints
< 1.0.0-beta.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-306

Missing Authentication

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32993
Advisory
https://github.com/rustfs/rustfs/security/advisories/GHSA-xp32-gxq2-3v52
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32993		Advisory
https://github.com/rustfs/rustfs/security/advisories/GHSA-xp32-gxq2-3v52		x_refsource_CONFIRM