Exploitation Summary
EIP tracks 3 public exploits for CVE-2025-68926. PoCs published by Chocapikk, Arcueld, materaj2. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Go-based exploit for CVE-2025-68926, which leverages a hardcoded gRPC authentication token in RustFS versions < 1.0.0-alpha.77. The exploit demonstrates unauthenticated access to gRPC services, enabling file read/write operations and system information disclosure.
Description
RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.
Exploits (3)
This repository contains a functional Go-based exploit for CVE-2025-68926, which leverages a hardcoded gRPC authentication token in RustFS versions < 1.0.0-alpha.77. The exploit demonstrates unauthenticated access to gRPC services, enabling file read/write operations and system information disclosure.
The repository contains a scanner for CVE-2025-68926, which checks for vulnerability status and retrieves server properties. It includes gRPC protocol buffer files and a Python script for single or batch target detection.
This repository contains a functional exploit script for CVE-2025-68926, which targets a hardcoded gRPC authentication token in RustFS. The script demonstrates authentication bypass, information disclosure, credential theft, and destructive operations using the hardcoded token 'rustfs rpc'.
Nuclei Templates (1)
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H