CVE-2025-68926: 
Rust vulnerability analysis and mitigation

CVE-2025-68926 is a critical hardcoded credential vulnerability in RustFS, a distributed object storage system built in Rust, that allows unauthenticated remote attackers to bypass gRPC authentication and execute privileged operations. The vulnerability affects all RustFS versions from 1.0.0-alpha.13 through 1.0.0-alpha.77, and was disclosed on December 30, 2025, by bilisheep of the Xmirror Security Team. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, RustFS Advisory).

The root cause is classified under CWE-798 (Use of Hard-coded Credentials) and CWE-287 (Improper Authentication). RustFS implements gRPC authentication via a check_auth interceptor in rustfs/src/server/http.rs (lines 679–686) that compares the incoming authorization metadata header against the hardcoded string literal "rustfs rpc" — the same token is also embedded in the client-side code at crates/protos/src/lib.rs (lines 153–174). Because the token is publicly visible in the open-source repository, non-configurable, and identical across every RustFS deployment, any attacker with TCP access to port 9000 can supply the header -H 'authorization: rustfs rpc' using a tool such as grpcurl to authenticate against all 50+ gRPC methods exposed by NodeServiceServer (GitHub Advisory, RustFS Advisory).

Successful exploitation grants an unauthenticated remote attacker full control over the RustFS cluster, with high confidentiality, integrity, and availability impact. An attacker can read arbitrary stored objects (ReadAll/ReadAt), harvest IAM credentials and service account tokens (LoadUser, LoadServiceAccount, LoadPolicy), inject or overwrite data (WriteAll, WriteStream, WriteMetadata), delete entire buckets or storage volumes (DeleteBucket, DeleteVolume), disrupt cluster replication (ReloadSiteReplicationConfig), and force service shutdown (SignalService). The breadth of exposed management APIs also enables lateral movement through harvested credentials and persistent backdoor installation via arbitrary file writes (RustFS Advisory).

Public proof-of-concept code is available in multiple GitHub repositories, including Chocapikk/CVE-2025-68926, Arcueld/CVE-2025-68926, and materaj2/CVE-2025-68926-repo, and a Nuclei detection template was merged into the ProjectDiscovery nuclei-templates repository. The EPSS score is approximately 7.71% (92nd percentile), indicating elevated exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, and no confirmed in-the-wild exploitation has been reported, though the trivial exploitation complexity (a single grpcurl command, under one minute) and public token knowledge make opportunistic scanning highly likely (GitHub Advisory, RustFS Advisory).

1. Reconnaissance: Identify internet-facing RustFS instances using Shodan, Censys, or FOFA by searching for services on TCP port 9000 running RustFS (versions alpha.13 through alpha.77).
2. Obtain proto file: Clone the public RustFS repository (git clone https://github.com/rustfs/rustfs.git) to obtain the gRPC service definition at crates/protos/src/node.proto, required for grpcurl invocations.
3. Confirm authentication enforcement: Send an unauthenticated request to verify the target is a vulnerable RustFS instance: grpcurl -plaintext -d '{}' <target>:9000 node_service.NodeService/Ping — expect an Unauthenticated error.
4. Authenticate with hardcoded token: Supply the publicly known token to bypass authentication: grpcurl -plaintext -H 'authorization: rustfs rpc' -import-path ./crates/protos/src -proto node.proto -d '{}' <target>:9000 node_service.NodeService/Ping — a successful response confirms authentication bypass.
5. Enumerate and exfiltrate: Call ServerInfo, DiskInfo, ListBucket, LoadUser, and LoadPolicy to harvest configuration data, credentials, and IAM policies.
6. Execute privileged operations: Depending on objective — destroy data via DeleteBucket/DeleteVolume, inject backdoors via WriteAll, escalate privileges via LoadServiceAccount, or disrupt the cluster via SignalService (RustFS Advisory, GitHub Advisory).

• Network: Unexpected inbound TCP connections to port 9000 from external or untrusted IP addresses; gRPC requests containing the HTTP/2 header authorization: rustfs rpc in network captures; outbound connections from the RustFS host to unknown external IPs following gRPC activity.
• Logs: RustFS access logs showing successful gRPC calls (non-Unauthenticated responses) to sensitive methods such as ServerInfo, ListBucket, LoadUser, LoadPolicy, DeleteBucket, DeleteVolume, WriteAll, or SignalService from unexpected source IPs; absence of corresponding legitimate administrative activity.
• File System: Unexpected new files written to storage volumes or configuration paths (e.g., .rustfs.sys/config.json) via WriteAll or WriteMetadata; missing buckets or volumes consistent with DeleteBucket/DeleteVolume calls; unfamiliar scripts or binaries in storage paths.
• Process: Unusual process behavior on the RustFS node following SignalService calls, such as unexpected restarts or shutdowns of the RustFS service (RustFS Advisory).

Upgrade RustFS to version 1.0.0-alpha.78 or later, which replaces the hardcoded token with a proper configurable authentication mechanism (GitHub Advisory). As an interim measure, restrict network access to TCP port 9000 using host-based firewalls, network ACLs, or security groups so that only trusted cluster nodes can reach the gRPC service. Additionally, enable mTLS for gRPC communication if supported by your deployment, implement IP allowlisting for the gRPC port, and monitor port 9000 access logs for unauthorized connection attempts. If compromise is suspected, rotate all IAM credentials, service account tokens, and access keys stored in the affected RustFS cluster.

The vulnerability was discovered and responsibly reported by bilisheep of the Xmirror Security Team and disclosed via GitHub Security Advisories on December 30, 2025 (RustFS Advisory). Security media outlets including SecurityOnline.info and HackMag covered the issue, highlighting the trivial exploitation complexity and broad impact on distributed storage clusters. The vulnerability appeared in CISA's weekly vulnerability bulletin (SB26-005) and trended in community CVE watch lists on Reddit for the weeks of January 5 and 7, 2026. Multiple PoC repositories and a Nuclei detection template were published within days of disclosure, reflecting significant community interest.