{"id":"CVE-2026-22782","aliases":["GHSA-333v-68xh-8mmq"],"url":"https://o3.security/vulnerability/CVE-2026-22782","summary":"RustFS RPC signature verification logs shared secret","details":"### Summary\nInvalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RPC calls.\n\n### Details\nIn [`crates/ecstore/src/rpc/http_auth.rs:115-122`](https://github.com/rustfs/rustfs/blob/9e162b6e9ebb874cc1d06a7b33bc4a05786578aa/crates/ecstore/src/rpc/http_auth.rs#L115-L122) , the invalid signature branch logs sensitive data:\n```rs\nif signature != expected_signature {\n    error!(\n        \"verify_rpc_signature: Invalid signature: secret {}, url {}, method {}, timestamp {}, signature {}, expected_signature {}\",\n        secret, url, method, timestamp, signature, expected_signature\n    );\n\n    return Err(std::io::Error::other(\"Invalid signature\"));\n}\n```\n\nThis log line includes `secret` and `expected_signature`, both derived from the shared HMAC key. Any invalidly signed request triggers this path. The function is reachable from RPC and admin request handlers.\n\n### PoC\n1. Run RustFS with error logging enabled.\n1. Send a request with an invalid signature:\n    ```\n     ts=$(date +%s)\n     curl -v \\\n       -H \"x-rustfs-timestamp: $ts\" \\\n       -H \"x-rustfs-signature: invalid-signature\" \\\n       \"http://localhost:9000/rustfs/rpc/read_file_stream?disk=foo&volume=bar&path=baz&offset=0&length=1\"\n    ```\n1. Observed output:\n    ```\n     HTTP 403 AccessDenied: Invalid signature\n     verify_rpc_signature: Invalid signature: secret rustfsadmin, url /rustfs/rpc/read_file_stream?disk=foo&volume=bar&path=baz&offset=0&length=1, method GET, timestamp 1767852115, signature invalid-signature, expected_signature oisNxNRTb80GXf97s/PGdScJzu8QB9Oxs+uOwf8RiK8=\n    ```\n### Impact\n\n- Exposes the shared RPC HMAC secret to log readers.\n- Enables attackers with log access to forge valid RPC signatures and make unauthorized RPC calls.","published":"2026-01-16T16:14:15.203Z","modified":"2026-08-12T03:51:12.598312495Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"rustfs","fixedVersion":"1.0.0-alpha.80"}],"fix":{"url":"https://github.com/rustfs/rustfs/commit/6b2eebee1d07399ef02c0863bd515b4412a5a560","label":"rustfs/rustfs@6b2eebe"},"references":[{"type":"WEB","url":"https://github.com/rustfs/rustfs/blob/9e162b6e9ebb874cc1d06a7b33bc4a05786578aa/crates/ecstore/src/rpc/http_auth.rs#L115-L122"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22782.json"},{"type":"ADVISORY","url":"https://github.com/rustfs/rustfs/security/advisories/GHSA-333v-68xh-8mmq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22782"},{"type":"FIX","url":"https://github.com/rustfs/rustfs/commit/6b2eebee1d07399ef02c0863bd515b4412a5a560"},{"type":"PACKAGE","url":"https://github.com/rustfs/rustfs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.598312495Z"}}