Authentication Vulnerability in RustFS Object Storage System

CVE-2025-68926

What is CVE-2025-68926?

CVE-2025-68926 is an authentication vulnerability found in RustFS, a distributed object storage system developed in Rust. This product is designed for scalable and efficient storage solutions, often employed in cloud-native environments. The vulnerability arises from the use of a hardcoded static authentication token, "rustfs rpc", which is exposed in the source code and used across all deployments. This token is embedded in both the client and server configurations, making it non-configurable and lacking any mechanisms for token rotation. As a result, attackers with network access to the gRPC port can exploit this flaw to authenticate themselves, enabling them to perform privileged operations such as data deletion, manipulation of access policies, and modifications to cluster settings. Without proper fixes, this vulnerability poses significant risks to organizations relying on RustFS for their data storage needs.

Potential impact of CVE-2025-68926

1. Unauthorized Access and Control: The hardcoded nature of the authentication token allows any attacker with network access to gain unauthorized access to the system, which could lead to control over sensitive data and vital operational functions.

2. Data Loss and Integrity Issues: Attackers exploiting this vulnerability could execute destructive actions, including data deletion or tampering, resulting in permanent data loss and compromised integrity of storage systems.

3. Compromise of System Configurations: The ability to alter critical configurations poses a risk to the overall security posture of an organization, as it may facilitate further unauthorized activities, potentially leading to a domino effect of security breaches throughout interconnected systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References