CVE-2025-68926

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66::::rust::*
	cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8::::rust::*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9::::rust::*

History

17 Jun 2026, 09:59

Type	Values Removed	Values Added
Summary		(es) RustFS es un sistema de almacenamiento de objetos distribuido construido en Rust. En versiones anteriores a 1.0.0-alpha.78, RustFS implementa la autenticación gRPC utilizando un token estático codificado de forma rígida 'rustfs rpc' que está expuesto públicamente en el repositorio de código fuente, codificado de forma rígida tanto en el lado del cliente como en el del servidor, no configurable sin ningún mecanismo para la rotación de tokens, y universalmente válido en todas las implementaciones de RustFS. Cualquier atacante con acceso de red al puerto gRPC puede autenticarse utilizando este token conocido públicamente y ejecutar operaciones privilegiadas, incluyendo destrucción de datos, manipulación de políticas y cambios en la configuración del clúster. La versión 1.0.0-alpha.78 contiene una solución para el problema.

16 Jan 2026, 19:31

Type	Values Removed	Values Added
First Time		Rustfs rustfs Rustfs
References	~~() https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj -~~	() https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj - Exploit, Vendor Advisory
CPE		cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39::::rust::* cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49::::rust::*

05 Jan 2026, 15:15

Type	Values Removed	Values Added
Summary	(en) RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.77, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.77 contains a fix for the issue.	(en) RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

30 Dec 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-30 17:15

Updated : 2026-06-17 09:59

NVD link : CVE-2025-68926

Mitre link : CVE-2025-68926

CVE.ORG link : CVE-2025-68926

JSON object : View

Products Affected

rustfs

rustfs

CWE

CWE-287

Improper Authentication

CWE-798

Use of Hard-coded Credentials

9.8 /10