RustFS version releases before 1.0.0-beta.2 embed a 2048‑bit RSA private key in the source and binary. The key is used to verify license tokens, so anyone who can obtain it can create arbitrary license tokens with any subject or expiration. This defeats the license enforcement and allows an attacker to run RustFS with full privileges or enable features that would otherwise be restricted.

The RustFS project, distributed under the rustfs:rustfs brand, is affected in all releases up to 1.0.0-beta.1. Users running those older versions should consult the project’s release notes and upgrade to 1.0.0-beta.2 or later.

The CVSS score of 8.7 highlights this vulnerability as high severity. Because the key is stored in the binary and source, an attacker who has access to the repository or the compiled package can easily retrieve it and generate valid license tokens; however, the availability of public exploitation is not known and it is not listed in the CISA KEV catalog. The exploit probability is therefore considered moderate for environments where the binary or source can be inspected. The vulnerability’s main impact is the potential for an attacker to abuse backed‑by‑license functionality or elevate privileges within a RustFS deployment.