CVE-2025-68926

RustFS before 1.0.0-alpha.78 authenticates gRPC clients with a single hardcoded static token ("rustfs rpc") that is published in the public source code, is hardcoded on both client and server, is non-configurable with no rotation mechanism, and is valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate with this publicly known token without possessing any secret. Successful access allows execution of privileged operations, including data destruction, policy manipulation, and cluster configuration changes. All deployments running affected versions are impacted, with risk highest where the gRPC port is reachable from untrusted networks. No in-the-wild exploitation is confirmed, but a public security advisory is available and EPSS assigns a 31.4% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade RustFS to 1.0.0-alpha.78 or later. Until upgraded, restrict network access to the gRPC port (firewall/ACL) so it is not reachable from untrusted networks, since the token is fixed and non-rotatable in affected versions. Audit clusters for unexpected policy changes, configuration modifications, or data loss, and check whether the gRPC port is exposed beyond trusted interfaces.