CVE-2026-22782

Invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls.

Details

In crates/ecstore/src/rpc/http_auth.rs:115-122 , the invalid signature branch logs sensitive data:

if signature != expected_signature {
    error!(
        "verify_rpc_signature: Invalid signature: secret {}, url {}, method {}, timestamp {}, signature {}, expected_signature {}",
        secret, url, method, timestamp, signature, expected_signature
    );

    return Err(std::io::Error::other("Invalid signature"));
}

This log line includes secret and expected_signature, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers.

PoC

1. Run RustFS with error logging enabled.
2. Send a request with an invalid signature:

    ts=$(date +%s)
    curl -v \
      -H "x-rustfs-timestamp: $ts" \
      -H "x-rustfs-signature: invalid-signature" \
      "http://localhost:9000/rustfs/rpc/read_file_stream?disk=foo&volume=bar&path=baz&offset=0&length=1"
   

3. Observed output:

    HTTP 403 AccessDenied: Invalid signature
    verify_rpc_signature: Invalid signature: secret rustfsadmin, url /rustfs/rpc/read_file_stream?disk=foo&volume=bar&path=baz&offset=0&length=1, method GET, timestamp 1767852115, signature invalid-signature, expected_signature oisNxNRTb80GXf97s/PGdScJzu8QB9Oxs+uOwf8RiK8=
   

• Exposes the shared RPC HMAC secret to log readers.
• Enables attackers with log access to forge valid RPC signatures and make unauthorized RPC calls.

Kodem intelligence

1. What is CVE-2026-22782? CVE-2026-22782 is a low-severity security vulnerability in rustfs (rust), affecting versions >= 1.0.0-alpha.1, <= 1.0.0-alpha.79. It is fixed in 1.0.0-alpha.80.
2. Which versions of rustfs are affected by CVE-2026-22782? rustfs (rust) versions >= 1.0.0-alpha.1, <= 1.0.0-alpha.79 is affected.
3. Is there a fix for CVE-2026-22782? Yes. CVE-2026-22782 is fixed in 1.0.0-alpha.80. Upgrade to this version or later.
4. Is CVE-2026-22782 exploitable, and should I be worried? Whether CVE-2026-22782 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-22782 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-22782? Upgrade rustfs to 1.0.0-alpha.80 or later.