The get_shared_secret function in RustFS falls back to a hard‑coded public secret when no custom secret is set, so internode RPC calls are authenticated with a predictable key. This flaw allows any node or attacker who gains access to the internal RPC channel to impersonate a legitimate peer, potentially performing unauthorized data operations or disrupting the cluster. The weakness is a credential‑in‑source‑code error (CWE‑798), leading to authentication bypass.

The vulnerability affects the RustFS distributed object storage system for all releases prior to 1.0.0‑beta.2. Any deployment using the default embedded key “rustfsadmin” without setting RUSTFS_RPC_SECRET or a global S3 secret key is susceptible.

With a CVSS score of 9.8, this flaw is considered critical. While no EPSS score is currently available, the high severity and the absence from the CISA KEV catalog do not diminish its threat. An attacker would need to join the internode RPC network or compromise an existing node; the default key then enables impersonation and bypasses authentication. The attack surface is constrained to nodes that have not configured a custom secret, so internal or compromised environments are the most likely vectors.