RustFS exposed the /profile/cpu and /profile/memory endpoints before ver 1.0.0‑beta.2 to unauthenticated users through a missing authentication whitelist. The CPU profiling handler performs a 60‑second capture per request, consuming substantial processor resources, while the response body includes the server’s absolute filesystem path, leaking internal information. These weaknesses constitute a privileged action without credentials that could allow an attacker to degrade performance or gather sensitive metadata.

The vulnerability affects RustFS, the distributed object storage system written in Rust, in all versions prior to 1.0.0‑beta.2. Build configurations that use glibc are explicitly impacted because the profiling routine is invoked for supported builds. Any publicly accessible RustFS instance running an affected version is therefore vulnerable.

The flaw can be exercised with a simple HTTP request to /profile/cpu or /profile/memory, so exploitation is straightforward and does not require special credentials. The CVSS score of 8.8 indicates high severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the attack surface of wide‑area access to a Docker‑based service remains significant. The attack vector is inferred to be remote over HTTP; the potential impact includes prolonged CPU usage per request and disclosure of server paths.