CVE-2025-68926: PoC Demonstration of RustFS gRPC Hardcoded Token Exposure
RustFS is an open-source, distributed object storage platform designed to provide scalable, high-performance storage for modern infrastructure environments. It is commonly deployed in clustered, containerized, and cloud-based setups, where internal gRPC services are used for node communication and administrative management.
Executive Summary:
CVE-2025-68926 is a critical authentication and access control vulnerability affecting RustFS, an open-source distributed object storage platform. The issue arises from the use of a hardcoded gRPC authentication token that is trusted by the server without adequate identity verification or authorization checks. As a result, network-reachable clients supplying the static token can authenticate to the gRPC management interface and invoke internal administrative APIs intended only for trusted cluster nodes.
Exploitation allows unauthenticated attackers to enumerate cluster topology, identify internal storage disks, and access sensitive configuration and system metadata under internal namespaces such as .rustfs.sys. Although the vulnerability does not permit direct data modification or remote code execution, the exposed information significantly weakens the security posture of affected deployments by enabling reconnaissance and potential follow-on attacks. Deployments exposing the gRPC interface beyond strictly controlled internal networks are at elevated risk, making network restriction and architectural hardening essential until the underlying design flaw is resolved.
Vulnerability Overview:
|
Attribute |
Details |
|
CVE ID |
CVE-2025-68926 |
|
Vulnerability Name |
RustFS Hardcoded gRPC Authentication Token |
|
Vulnerability Type |
Authentication Bypass, Improper Access Control (CWE-798, CWE-287, CWE-284) |
|
Severity |
High |
|
CVSS v3.1 Base Score |
9.8 |
|
CVSS v3.1 Vector |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
Affected Component |
RustFS gRPC administrative interface |
|
Vulnerable Versions |
RustFS versions using a hardcoded gRPC authentication token (1.0.0-alpha.13 through 1.0.0-alpha.77).
|
|
Patched Versions |
Upgrade to 1.0.0-alpha.78 |
|
Attack Vector |
Network (AV:N) – Exploitable remotely via access to the gRPC management port |
|
Privileges Required |
None (PR:N) – Authentication bypass using a static token |
|
User Interaction |
None (UI:N) – Exploitation is fully automated |
|
Scope |
Unchanged (S:U) – Impact remains within the RustFS service |
Vulnerability Details:
Root Cause
CVE-2025-68926 is caused by RustFS relying on a hardcoded gRPC authentication token without enforcing authorization controls on internal administrative APIs. The server accepts a static token during gRPC authentication and allows access to privileged RPC methods without validating client identity or role. As a result, possession of a predictable token grants broad access to internal cluster management functionality, violating the principle of least privilege.The issue originates from:
-
Authentication handling in the RustFS server (rustfs/src/server/http.rs), where the static token is validated
-
Unrestricted internal RPC definitions in the RustFS protobuf layer (crates/protos/src/lib.rs), which expose administrative methods without role-based restrictions
As a result, possession of a predictable token grants broad access to internal cluster management functionality, violating the principle of least privilege.
Exploitation Flow:
Exposure & Risk:
Impact
Exploitation of CVE-2025-68926 allows unauthenticated attackers to access internal administrative gRPC APIs exposed by RustFS. While the vulnerability does not directly enable data modification or remote code execution, it exposes sensitive internal information such as cluster topology, disk layout, system configuration files, and operational metadata stored under the .rustfs.sys namespace. This information can significantly aid reconnaissance, facilitate targeted attacks against storage infrastructure, and increase the risk of further compromise in distributed environments. The primary security impact is a high confidentiality risk due to unauthorized insight into internal cluster state and configuration.
Attack Surface
Any RustFS deployment exposing its gRPC management interface over a network is potentially affected. This includes containerized deployments, on-premise clusters, cloud-hosted environments, and systems operating within flat or insufficiently segmented networks. Exploitation requires only network reachability to the gRPC port and knowledge of the static authentication token; no valid user credentials, prior authentication, or elevated privileges are required. Systems relying on perimeter trust or assuming internal-only access are especially vulnerable.
Stealth Factor
Exploitation of CVE-2025-68926 is low-noise and difficult to detect. Unauthorized access is performed through legitimate gRPC calls using expected protocol behavior, without triggering errors, service crashes, or authentication failures. Standard RustFS logging does not clearly distinguish between legitimate internal node communication and malicious external requests using the hardcoded token. As a result, unauthorized access attempts may go unnoticed unless strict network controls or enhanced monitoring are in place. Mitigation through interface restriction and removal of static authentication mechanisms is therefore critical.
PoC and Active Exploitation:
The exploitation of CVE-2025-68926 was conducted using a publicly available proof-of-concept implementation. The PoC is designed to demonstrate how RustFS exposes internal administrative gRPC APIs through the use of a hardcoded authentication token, allowing unauthenticated clients to interact with cluster-internal services.
Unlike memory corruption vulnerabilities, this issue represents a logical authentication failure, where trust is implicitly granted based on the presence of a static token rather than verifiable identity or role-based authorization.
The proof-of-concept tool is a standalone client application that communicates directly with the RustFS gRPC service. Its primary purpose is to validate whether privileged internal RPC methods can be accessed without legitimate credentials.
The PoC performs the following actions:
-
Establishes a gRPC connection to the RustFS service
-
Injects the hardcoded authentication token into gRPC metadata
-
Invokes internal administrative RPC methods
-
Parses and displays returned cluster metadata and filesystem structures
The tool does not modify data and is limited to read-only enumeration to safely demonstrate the impact of the vulnerability.
Exploit Execution
The vulnerability was triggered by executing the PoC binary against a RustFS instance running in a controlled laboratory environment.
./exploit localhost 19010
The target RustFS service was listening on TCP port 19010, which corresponds to the internal gRPC management interface. No authentication credentials, TLS certificates, or session tokens were required to successfully invoke privileged RPC methods.
Unauthorized Administrative API Access
Upon execution, the PoC successfully invoked the internal ServerInfo administrative RPC method. This call is intended exclusively for trusted cluster nodes and returns sensitive operational metadata.
The response included:
-
Cluster service status (online)
-
Bound service address (0.0.0.0:9000)
-
RustFS version identifier (1.0.0-alpha.76)
-
Active node and disk topology data
The successful execution of this RPC confirms that the gRPC service accepts the static token as sufficient authentication, without validating the origin or role of the caller.
Disk Enumeration and Internal Metadata Exposure
After retrieving server information, the PoC extracted disk identifiers from the response and proceeded to enumerate storage backends attached to the cluster.
The exploit discovered multiple internal disks:
Discovered 4 disks:
- /data/rustfs0
- /data/rustfs1
- /data/rustfs2
- /data/rustfs3
These paths correspond to internal storage volumes that are not intended to be discoverable by external or unauthenticated clients.
Recursive Internal Directory Exploration
Using the discovered disk paths, the PoC recursively accessed internal RustFS system directories under the .rustfs.sys namespace. These directories contain configuration, usage statistics, and cluster metadata used by the RustFS control plane.
Accessible internal objects included:
-
.rustfs.sysconfig/config.json
-
IAM configuration metadata
-
Bucket usage statistics
-
Pool and disk metadata files
-
Data usage state tracking files
These objects represent core cluster configuration data and are typically accessible only to trusted RustFS nodes during normal operation.
Validation of Active Exploitation
The output captured during execution provides clear evidence of active exploitation:
-
Internal administrative RPCs were invoked successfully
-
Sensitive configuration metadata was enumerated
-
No authentication or authorization barriers were enforced
-
The gRPC service accepted requests from an untrusted client
-
Exploitation occurred without service interruption or errors
Importantly, this behavior demonstrates that the issue is reproducible in deployments where the RustFS gRPC interface is network-reachable. The vulnerability is reproducible under default deployment conditions where the gRPC interface is network-reachable.
Reliability and Exploit Characteristics
The exploit is highly reliable due to the deterministic nature of the flaw:
-
The hardcoded token value is static
-
Authentication checks are performed using simple string comparison
-
No rate-limiting or anomaly detection is present
-
Results are consistent across executions and environments
Unlike memory corruption vulnerabilities, exploit success does not depend on runtime state, heap layout, or timing conditions. Any client capable of reaching the gRPC service can reproduce the behavior.
Mitigation:
To mitigate CVE-2025-68926, affected organizations must immediately upgrade to patched versions and implement network restrictions.
Upgrade to Patched Version
Upgrade to 1.0.0-alpha.78
Immediate Defensive Actions
-
Restrict network access to the RustFS gRPC port using firewall rules or network policies.
-
Bind the gRPC service to localhost or trusted internal interfaces only, preventing external reachability.
-
Isolate RustFS nodes within segmented networks to reduce lateral exposure.
Configuration and Deployment Hardening
-
Disable or limit external access to internal management APIs where possible.
-
Deploy RustFS behind strict ingress controls in containerized and cloud environments.
-
Monitor gRPC traffic for unexpected access patterns originating outside trusted nodes.
Long-Term Remediation
-
Remove hardcoded authentication tokens from the codebase.
-
Implement mutual TLS (mTLS) to establish cryptographic trust between nodes.
-
Enforce role-based access control (RBAC) on administrative gRPC methods.
-
Adopt secure secret management practices with support for rotation and revocation.
Until an official patch is available, reducing network exposure remains the most effective mitigation strategy.
Timeline:
Conclusion:
CVE-2025-68926 highlights a critical design flaw in RustFS stemming from the use of a hardcoded gRPC authentication token and insufficient access controls around internal administrative APIs. While the vulnerability does not directly enable destructive actions, it exposes sensitive cluster metadata and configuration information that can significantly weaken the security posture of affected environments.
This issue underscores the importance of strong authentication, proper authorization boundaries, and secure defaults in distributed systems. Organizations running RustFS should assess their deployments for exposed management interfaces and apply mitigations immediately. Developers and maintainers are encouraged to address the underlying design issues to prevent similar vulnerabilities in future releases.