RustFS, a distributed object storage system written in Rust, logs access key, secret key, and session token values to the application log at the INFO level for versions alpha.13 through alpha.81. This results in plaintext credential material appearing in the log files, which can be read by any process or user that has access to the logs, potentially allowing compromise of the credentials. The weakness is a Log Writing flaw (CWE‑532) that directly leaks sensitive data to application monitoring systems or external log collectors.

The affected product is RustFS. Vulnerable releases include alpha.13 through alpha.81. All environments running these versions are susceptible until the software is upgraded to alpha.82 or a later version where the logging behavior has been removed or sanitized.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, any attacker who can read the application logs—whether an insider or an external log collector—can obtain the credentials in clear text. The risk is therefore significant for environments that expose log data or lack strict log access controls, while the probability of an attack occurring remains comparatively low.