CVE-2025-68926Disclosure(rustfs / rustfs)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

rustfs CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgj

Weakness type (CWE)

CWE-287CWE-798

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

rustfs

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-02-04); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

rustfs

Products

rustfs

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-04	1	Disclosure1
2026-05-28	1	General1

Full discourse2 posts

cbro@broady134d
General
@theutibeumanah @gwenshap I've been checking out seaweedfs https://nvd.nist.gov/vuln/detail/CVE-2025-68926
Post summary
The user shares a link to the NVD entry for CVE-2025-68926 while saying they are checking out SeaweedFS, with no additional details about PoCs, exploits, patches, or active exploitation.
1002072
3.1K followersView on X
Komodo Cyber Security@Komodosec247d
Disclosure
#VulnerabilityReport #AuthenticationBypass CVE-2025-68926: Critical Hardcoded Credential Flaw Exposes RustFS Storage Clusters https://securityonline.info/cve-2025-68926-critical-hardcoded-credential-flaw-exposes-rustfs-storage-clusters/?utm_source=dlvr.it&utm_medium=twitter
Post summary
CVE-2025-68926 is a newly disclosed critical vulnerability involving hardcoded credentials that allows authentication bypass in RustFS Storage Clusters.
0000077
1.5K followersView on X

CPE platform detail77 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

77 of 77 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-
App	rustfs	rustfs	1.0.0	rust	-

Explore more

Back to dashboard rustfs CVEs rustfs vulnerabilities