The internode RPC HMAC secret is derived from the S3 credential pair via
`derive_rpc_secret` when `RUSTFS_RPC_SECRET` is unset. The derivation uses the
secret key as the HMAC key, so when the default secret key (`rustfsadmin`) is in
effect the derived RPC secret is a fixed, publicly computable value. Any network
peer can then forge valid `x-rustfs-signature` headers and invoke internode RPC
routes (e.g. `read_file_stream`), bypassing S3 IAM entirely.
`normalize_rpc_secret` already rejected the literal default when it was supplied
directly, but `resolve_rpc_secret` still derived a secret from the default
credential pair. Make the derivation path fail closed: refuse to derive while
the default secret key is in effect, forcing operators to set `RUSTFS_RPC_SECRET`
(or a non-default `RUSTFS_SECRET_KEY`). A default access key paired with a
non-default secret key remains safe and is still allowed.
Addresses GHSA-68cw-96m3-h2cf (incomplete-fix follow-up to CVE-2026-45039).
* fix: tighten list handling and s3 test support
* chore: tidy imports and metric updates
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
Signed-off-by: Zhengchao An <[email protected]>
* fix: address s3tests review follow-ups
---------
Signed-off-by: Zhengchao An <[email protected]>
Co-authored-by: Zhengchao An <[email protected]>
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
