ThreatsDay Bulletin: RustFS Flaw, Iranian Ops, WebUI RCE, Cloud Leaks, and 12 More Stories

ThreatsDay Bulletin highlights a critical RustFS flaw, disclosed by the RustFS project, that stems from a hard-coded, publicly exposed gRPC authentication token used on both client and server sides. The advisory assigns a CVSS score of 9.8 and states the vulnerability affects versions alpha.13 through alpha.77, with a patch available in 1.0.0-alpha.78 released on 30 December 2025.

It notes there is no CVE identifier for this issue, and that the token is non-configurable and universally valid across deployments, enabling privileged operations or data destruction if exploited with network access to the gRPC port. The bulletin also covers related risk items, but the RustFS flaw is singled out as a high-severity case in this week’s roundup, underscoring how a single hard-coded credential can undermine cluster security.

According to The Hacker News, the emergence of such flaws continues to stress the importance of prompt patching and token management in evolving software ecosystems.