{"cve":"CVE-2025-68926","nvd":{"published":"2025-12-30T17:15:43.613","modified":"2026-06-17T09:59:50.123","status":"Analyzed","description":"RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `\"rustfs rpc\"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-287","CWE-798"],"references":["https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj"],"products":["rustfs:rustfs"],"source":"nvd","synced_at":"2026-10-19T22:18:08.089039631+00:00"},"epss":{"cve":"CVE-2025-68926","score":0.3185,"percentile":0.98302,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-h956-rh7x-ppgj","url":"https://osv.dev/vulnerability/GHSA-h956-rh7x-ppgj","summary":"RustFS has a gRPC Hardcoded Token Authentication Bypass","modified":"2026-02-03T03:16:25.981438Z","packages":[{"ecosystem":"crates.io","name":"rustfs","purl":"pkg:cargo/rustfs","ranges":[">=1.0.0-alpha.13 <1.0.0-alpha.78"],"fixed":["1.0.0-alpha.78"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}