CVE-2026-45044

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, allowing any unauthenticated HTTP client to invoke profiling handlers without credentials. On supported builds (e.g., glibc), the handler invokes a fixed 60-second CPU profiling operation (dump_cpu_pprof_for(Duration::from_secs(60))). This may result in significant CPU resource consumption per request and can potentially lead to denial of service when abused. Additionally, the handler returns the server’s absolute filesystem path in the response body, resulting in information disclosure. This vulnerability is fixed in 1.0.0-beta.2.

• CWE-306

• https://github.com/rustfs/rustfs/security/advisories/GHSA-8784-9m7f-c6p6
• https://github.com/rustfs/rustfs/security/advisories/GHSA-8784-9m7f-c6p6

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45039RustFS is a distributed object storage system built in Rust.…9.8
• CVE-2026-4504A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. Th…7.3
• CVE-2026-45040RustFS is a distributed object storage system built in Rust.…5.3
• CVE-2026-45041RustFS is a distributed object storage system built in Rust.…8.7
• CVE-2026-45042RustFS is a distributed object storage system built in Rust.…7.1
• CVE-2026-45043RustFS is a distributed object storage system built in Rust.…9.3
• CVE-2026-45045Fiber is an Express inspired web framework written in Go. Pr…5.3
• CVE-2026-45046Gryph provides a security layer for AI coding agents. Prior …5.5
• CVE-2026-45047bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, th…7.5
• CVE-2026-4505A vulnerability has been found in eosphoros-ai DB-GPT up to …6.3
• CVE-2026-45053CubeCart is an ecommerce software solution. Prior to 6.7.0, …9.1
• CVE-2026-45054CubeCart is an ecommerce software solution. Prior to 6.7.0, …4.9