RustFS publishes an unauthenticated HTTP GET endpoint that reveals licence meta‑data such as subject and expiry timestamp without any access control. Affected versions are those prior to 1.0.0-beta.2. The leak does not immediately allow code execution or privilege escalation, but it provides attackers with licence details that could be used for business intelligence or to assess system readiness. The normal outcome is a moderate confidentiality breach with a CVSS score of 6.9.

RustFS 1.x running prior to 1.0.0-beta.2. Any deployment exposing the {“/rustfs/console/license”} endpoint is impacted. Versions 1.0.0-beta.2 and later contain the fix and are unaffected.

An attacker who can reach the console listener can issue a simple unsigned request and retrieve licence metadata. The vulnerability is not listed in the CISA KEV catalogue and its EPSS is unknown, but the CVSS score of 6.9 indicates a moderate risk. Because the endpoint does not require authentication, exploitation can be performed by anyone with network visibility into the console service.