CVE-2025-68926

CVE-2025-68926 is a critical-severity vulnerability in Rustfs with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 29% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-287.

Key facts

Description

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

Frequently asked questions

What is CVE-2025-68926?
RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.
How severe is CVE-2025-68926?
CVE-2025-68926 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-68926 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 29% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-68926?
CVE-2025-68926 primarily affects Rustfs. In total, 77 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-68926?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-68926 have an EU (EUVD) identifier?
Yes. CVE-2025-68926 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-205801.
When was CVE-2025-68926 published?
CVE-2025-68926 was published on 2025-12-30 and last updated on 2026-06-17.

References

Affected products (77)

More vulnerabilities in Rustfs

All CVEs affecting Rustfs →

Other CWE-287 (Improper Authentication) vulnerabilities

Browse all CWE-287 (Improper Authentication) vulnerabilities →