CVE

CVE-2025-68926

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

rustfs

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalNetwork Vulnerabilities~10 seconds

RustFS < 1.0.0-alpha.77 - Hardcoded gRPC Authentication Token

RustFS before 1.0.0-alpha.77 used a hardcoded gRPC authentication token "rustfs rpc" that could not be changed without recompiling and this allowed unauthenticated remote attackers to gain full administrative access to the gRPC API. References: https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj https://nvd.nist.gov/vuln/detail/CVE-2025-68926 Remediation: Upgrade to RustFS 1.0.0-alpha.77 or later.

9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: rustfs

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →