Zhengchao An 7b20554056 fix(credentials): fail closed when deriving RPC secret from default credentials (#4402) ...

The internode RPC HMAC secret is derived from the S3 credential pair via
`derive_rpc_secret` when `RUSTFS_RPC_SECRET` is unset. The derivation uses the
secret key as the HMAC key, so when the default secret key (`rustfsadmin`) is in
effect the derived RPC secret is a fixed, publicly computable value. Any network
peer can then forge valid `x-rustfs-signature` headers and invoke internode RPC
routes (e.g. `read_file_stream`), bypassing S3 IAM entirely.

`normalize_rpc_secret` already rejected the literal default when it was supplied
directly, but `resolve_rpc_secret` still derived a secret from the default
credential pair. Make the derivation path fail closed: refuse to derive while
the default secret key is in effect, forcing operators to set `RUSTFS_RPC_SECRET`
(or a non-default `RUSTFS_SECRET_KEY`). A default access key paired with a
non-default secret key remains safe and is still allowed.

Addresses GHSA-68cw-96m3-h2cf (incomplete-fix follow-up to CVE-2026-45039).

2026-07-08 09:31:25 +08:00

..

constants.rs

test(credentials): avoid printing default secret (#2820)

2026-05-06 05:19:42 +00:00

credentials.rs

fix(credentials): fail closed when deriving RPC secret from default credentials (#4402)

2026-07-08 09:31:25 +08:00

lib.rs

feat: improve legacy metadata and admin compatibility (#2202)

2026-03-18 21:05:09 +08:00

serde_datetime.rs

fix: stabilize s3-tests delete key-limit coverage (#4283)

2026-07-05 20:35:32 +08:00