RustFS: The 'rustfs rpc' Skeleton Key (CVE-2025-68926)
Jan 1, 2026·5 min read·28 visits
Executive Summary (TL;DR)
RustFS versions prior to 1.0.0-alpha.77 contain a hardcoded gRPC authentication token ('rustfs rpc'). Attackers can use this token to bypass all authentication checks, allowing them to delete buckets, modify policies, and seize control of the storage cluster via standard gRPC tools.
A critical authentication bypass in the RustFS distributed object storage system allows unauthenticated attackers to gain full administrative control by sending a specific hardcoded string in the gRPC authorization header.
Official Patches
Technical Appendix
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
RustFS RustFS | < 1.0.0-alpha.77 | 1.0.0-alpha.77 |
| Attribute | Detail |
|---|---|
| CWE | CWE-798 (Use of Hard-coded Credentials) |
| CVSS v3.1 | 9.8 (Critical) |
| Attack Vector | Network (gRPC) |
| Privileges Required | None |
| Port | 9000/TCP |
| Token Value | "rustfs rpc" |
MITRE ATT&CK Mapping
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.