Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-47136RustFS: Unauthenticated RustFS console license endpoint exposes license metadata

Medium 6.9

In plain English

A medium-severity information exposure in rustfs from rustfs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 76.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed license metadata without requiring authentication. The endpoint is registered on the console listener and returns JSON containing license information such as the license subject and expiration timestamp. Any client that can reach the console listener can query this endpoint without credentials. This vulnerability is fixed in 1.0.0-beta.2.

Affected products (as reported)

Vendor	Product	Versions
rustfs	rustfs	< 1.0.0-beta.2

Weakness: CWE-200, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/rustfs/rustfs/security/advisories/GHSA-xp32-gxq2-3v52 x_refsource_CONFIRM