QSearchQSearch

CVE-2026-47136

RustFS is a distributed object storage system built in Rust

Published: 2026-05-28 · Last updated: 2026-05-29

Severity and scoring

CWE
CWE-200, CWE-306

Description

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed license metadata without requiring authentication. The endpoint is registered on the console listener and returns JSON containing license information such as the license subject and expiration timestamp. Any client that can reach the console listener can query this endpoint without credentials. This vulnerability is fixed in 1.0.0-beta.2.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-12117 — Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to ...
  • CVE-2026-0647 — An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server
  • CVE-2026-12320 — Information disclosure in the Password Manager component (4.3 MEDIUM)
  • CVE-2026-12311 — Information disclosure, sandbox escape in the Security: Process Sandboxing component (4.7 MEDIUM)
  • CVE-2026-50870 — An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensi... (7.5 HIGH)