CVE-2025-68926: Critical Hardcoded Credential Flaw Exposes RustFS Storage Clusters

CVE-2025-68926, described as a critical hardcoded credential flaw, exposes RustFS storage clusters by embedding a static authentication token directly into the code. The vulnerability carries a near-max CVSS score of 9.8, highlighting its severity and ease of exploitation. The flaw lies in the gRPC authentication path, where a static string literal is used instead of dynamic secrets, with the secret token simply being “rustfs rpc”.

According to the vulnerability report, this token is publicly exposed in the source code repository and is universally valid across all RustFS deployments, meaning every default installation shares the same administrative password. Because it governs internal gRPC communication, possession of the token grants an attacker the same privileges as internal cluster nodes, potentially enabling data destruction, policy manipulation, and configuration changes.

The technical analysis notes the hardcoded token appears in rustfs/src/server/http[.]rs and is mirrored in crates/protos/src/lib[.]rs, leaving token rotation effectively impossible without code changes.