Read the docs
TI-2025-42382 Aliases CVE-2025-68926GHSA-h956-rh7x-ppgj

RustFS has a gRPC Hardcoded Token Authentication Bypass

Priority HIGH 82CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.3185 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed rustfs (rustfs): 1.0.0-alpha.78rustfs (crates.io): 1.0.0-alpha.78

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustfsrustfsbefore 1.0.0-alpha.781.0.0-alpha.78Patch availableCNA
—rustfs (crates.io)1.0.0-alpha.13 to before 1.0.0-alpha.781.0.0-alpha.78Patch availableGHSA-h956-rh7x-ppgj
  • rustfs Vendorrustfs Affected before 1.0.0-alpha.78 Fixed in 1.0.0-alpha.78 Patch available CNA
  • rustfs (crates.io) Vendor— Affected 1.0.0-alpha.13 to before 1.0.0-alpha.78 Fixed in 1.0.0-alpha.78 Patch available GHSA-h956-rh7x-ppgj

CPE configurations NVD · 77

CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:*1.0.0 alpha1Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*1.0.0 alpha10Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:*1.0.0 alpha11Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:*1.0.0 alpha12Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*1.0.0 alpha13Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*1.0.0 alpha14Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*1.0.0 alpha15Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*1.0.0 alpha16Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*1.0.0 alpha17Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*1.0.0 alpha18Vulnerablerustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:* Versions 1.0.0 alpha1 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:* Versions 1.0.0 alpha10 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:* Versions 1.0.0 alpha11 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:* Versions 1.0.0 alpha12 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:* Versions 1.0.0 alpha13 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:* Versions 1.0.0 alpha14 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:* Versions 1.0.0 alpha15 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:* Versions 1.0.0 alpha16 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:* Versions 1.0.0 alpha17 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:* Versions 1.0.0 alpha18 Vulnerable ·rustfs
Show 67 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*1.0.0 alpha19Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:*1.0.0 alpha2Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*1.0.0 alpha20Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*1.0.0 alpha21Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*1.0.0 alpha22Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*1.0.0 alpha23Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*1.0.0 alpha24Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*1.0.0 alpha25Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*1.0.0 alpha26Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*1.0.0 alpha27Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*1.0.0 alpha28Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*1.0.0 alpha29Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:*1.0.0 alpha3Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*1.0.0 alpha30Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*1.0.0 alpha31Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*1.0.0 alpha32Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*1.0.0 alpha33Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*1.0.0 alpha34Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*1.0.0 alpha35Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*1.0.0 alpha36Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*1.0.0 alpha37Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*1.0.0 alpha38Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*1.0.0 alpha39Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:*1.0.0 alpha4Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*1.0.0 alpha40Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*1.0.0 alpha41Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*1.0.0 alpha42Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*1.0.0 alpha43Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*1.0.0 alpha44Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*1.0.0 alpha45Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*1.0.0 alpha46Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*1.0.0 alpha47Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*1.0.0 alpha48Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*1.0.0 alpha49Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:*1.0.0 alpha5Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*1.0.0 alpha50Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*1.0.0 alpha51Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*1.0.0 alpha52Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*1.0.0 alpha53Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*1.0.0 alpha54Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*1.0.0 alpha55Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*1.0.0 alpha56Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*1.0.0 alpha57Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*1.0.0 alpha58Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*1.0.0 alpha59Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*1.0.0 alpha6Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*1.0.0 alpha60Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*1.0.0 alpha61Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*1.0.0 alpha62Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*1.0.0 alpha63Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*1.0.0 alpha64Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*1.0.0 alpha65Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*1.0.0 alpha66Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*1.0.0 alpha67Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*1.0.0 alpha68Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*1.0.0 alpha69Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:*1.0.0 alpha7Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*1.0.0 alpha70Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*1.0.0 alpha71Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*1.0.0 alpha72Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*1.0.0 alpha73Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*1.0.0 alpha74Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*1.0.0 alpha75Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*1.0.0 alpha76Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*1.0.0 alpha77Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:*1.0.0 alpha8Vulnerablerustfs
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:*1.0.0 alpha9Vulnerablerustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:* Versions 1.0.0 alpha19 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:* Versions 1.0.0 alpha2 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:* Versions 1.0.0 alpha20 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:* Versions 1.0.0 alpha21 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:* Versions 1.0.0 alpha22 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:* Versions 1.0.0 alpha23 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:* Versions 1.0.0 alpha24 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:* Versions 1.0.0 alpha25 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:* Versions 1.0.0 alpha26 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:* Versions 1.0.0 alpha27 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:* Versions 1.0.0 alpha28 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:* Versions 1.0.0 alpha29 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:* Versions 1.0.0 alpha3 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:* Versions 1.0.0 alpha30 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:* Versions 1.0.0 alpha31 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:* Versions 1.0.0 alpha32 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:* Versions 1.0.0 alpha33 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:* Versions 1.0.0 alpha34 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:* Versions 1.0.0 alpha35 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:* Versions 1.0.0 alpha36 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:* Versions 1.0.0 alpha37 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:* Versions 1.0.0 alpha38 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:* Versions 1.0.0 alpha39 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:* Versions 1.0.0 alpha4 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:* Versions 1.0.0 alpha40 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:* Versions 1.0.0 alpha41 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:* Versions 1.0.0 alpha42 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:* Versions 1.0.0 alpha43 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:* Versions 1.0.0 alpha44 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:* Versions 1.0.0 alpha45 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:* Versions 1.0.0 alpha46 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:* Versions 1.0.0 alpha47 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:* Versions 1.0.0 alpha48 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:* Versions 1.0.0 alpha49 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:* Versions 1.0.0 alpha5 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:* Versions 1.0.0 alpha50 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:* Versions 1.0.0 alpha51 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:* Versions 1.0.0 alpha52 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:* Versions 1.0.0 alpha53 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:* Versions 1.0.0 alpha54 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:* Versions 1.0.0 alpha55 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:* Versions 1.0.0 alpha56 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:* Versions 1.0.0 alpha57 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:* Versions 1.0.0 alpha58 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:* Versions 1.0.0 alpha59 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:* Versions 1.0.0 alpha6 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:* Versions 1.0.0 alpha60 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:* Versions 1.0.0 alpha61 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:* Versions 1.0.0 alpha62 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:* Versions 1.0.0 alpha63 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:* Versions 1.0.0 alpha64 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:* Versions 1.0.0 alpha65 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:* Versions 1.0.0 alpha66 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:* Versions 1.0.0 alpha67 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:* Versions 1.0.0 alpha68 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:* Versions 1.0.0 alpha69 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:* Versions 1.0.0 alpha7 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:* Versions 1.0.0 alpha70 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:* Versions 1.0.0 alpha71 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:* Versions 1.0.0 alpha72 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:* Versions 1.0.0 alpha73 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:* Versions 1.0.0 alpha74 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:* Versions 1.0.0 alpha75 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:* Versions 1.0.0 alpha76 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:* Versions 1.0.0 alpha77 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:* Versions 1.0.0 alpha8 Vulnerable ·rustfs
  • cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:* Versions 1.0.0 alpha9 Vulnerable ·rustfs

Remediation

  • Fix · CNA rustfs (rustfs) Fixed in 1.0.0-alpha.78
  • Fix · GHSA-h956-rh7x-ppgj rustfs (crates.io) Fixed in 1.0.0-alpha.78 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68926
  2. 2026-10-03 Alias added: GHSA-h956-rh7x-ppgj

References

Exploit 1

Advisory 1

Other 2

  • TI-2025-42176 RustFS Path Traversal Vulnerability CVSS 4.0HIGH 8.8
  • TI-2026-17564 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers CVSS 4.0HIGH 7.7
  • TI-2026-19963 RustFS Logs Sensitive Credentials in Plaintext CVSS 4.0MEDIUM 6.9
  • TI-2025-42706 RustFS gRPC GetMetrics deserialization panic enables remote DoS CVSS 4.0MEDIUM 5.5
  • TI-2026-17737 RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting CVSS 4.0MEDIUM 5.7
  • TI-2026-17736 RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation CVSS 4.0MEDIUM 5.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences