CVE-2025-68926

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

• CWE-287
• CWE-798

• https://github.com/rustfs/rustfs/security/advisories/GHSA-h956-rh7x-ppgjExploit, Vendor Advisory

Published

Dec 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6892An Incorrect Authorization vulnerability has been identified…8.7
• CVE-2025-68920C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12)…8.9
• CVE-2025-68921SteelSeries Nahimic 3 1.10.7 allows Directory traversal.7.8
• CVE-2025-68922OpenOps before 0.6.11 allows remote code execution in the Te…7.4
• CVE-2025-68924In Umbraco UmbracoForms through 8.13.16, an authenticated at…7.5
• CVE-2025-68925Jervis is a library for Job DSL plugin scripts and shared Je…5.3
• CVE-2025-68927Libredesk is a self-hosted customer support desk. Prior to v…6.1
• CVE-2025-68928Frappe CRM is an open-source customer relationship managemen…5.4
• CVE-2025-68929Frappe is a full-stack web application framework. Prior to v…9
• CVE-2025-6893An Execution with Unnecessary Privileges vulnerability has b…9.3
• CVE-2025-68930Versions of the Traccar open-source GPS tracking system up t…6.5
• CVE-2025-68931Jervis is a library for Job DSL plugin scripts and shared Je…7.5