RustFS, a distributed object storage system written in Rust, logs plaintext credentials—including SessionToken (JWT), SecretAccessKey, and complete JWT claims—when operating in debug mode. The flaw originates from unfiltered log output, enabling unprivileged users who can read server logs to obtain authentication credentials. This compromise could allow credential theft, session hijacking, or unauthorized access to stored data.

The vulnerability affects RustFS versions prior to 1.0.0‑beta.2. Users running any release before that milestone, especially on production deployments that enable debug logging (RUST_LOG=debug), are at risk.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the issue is not currently listed in CISA’s KEV catalog, suggesting no known exploit activity to date. Exploitation requires the attacker to read the server logs, which typically implies local or compromised system access. By downgrading the logging level or upgrading to a patched version, the risk can be mitigated.