Loading story…
A critical vulnerability, tracked as CVE-2025-68926, was discovered in the RustFS distributed object storage system. The flaw involves the use of a hardcoded static token ("rustfs rpc") for gRPC authentication, which is publicly exposed in the source code and is non-configurable, with no mechanism for token rotation. This token is valid across all RustFS deployments prior to version 1.0.0-alpha.77, allowing any attacker with network access to the gRPC port to authenticate and perform privileged operations such as data destruction, policy manipulation, and cluster configuration changes. The issue has been addressed in version 1.0.0-alpha.77, which removes the hardcoded credential and implements proper authentication controls.
Security researchers have rated this vulnerability as critical, assigning it a CVSS score of 9.8 due to the ease of exploitation and the potential impact on data integrity and availability. Organizations using affected versions of RustFS are strongly advised to upgrade to the patched release immediately to mitigate the risk of unauthorized access and potential compromise of storage clusters. No evidence of exploitation in the wild has been reported as of the latest advisories, but the public nature of the token significantly increases the risk of opportunistic attacks.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
A ProjectDiscovery nuclei-templates pull request was opened to add detection coverage for CVE-2025-68926. The submission noted the issue was verified against RustFS 1.0.0-alpha.76 and referenced GitHub Security Advisory GHSA-h956-rh7x-ppgj.
CVE-2025-68926 was publicly disclosed as a critical vulnerability affecting RustFS versions before 1.0.0-alpha.77. The flaw stems from a hardcoded static gRPC token ('rustfs rpc') that allows remote attackers with network access to bypass authentication and perform privileged operations.
RustFS fixed a critical authentication bypass issue in version 1.0.0-alpha.77 by removing the hardcoded gRPC token from both client and server components. Users were advised to upgrade to this version or later to mitigate the risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two critical hardcoded-secret weaknesses were disclosed in widely used open-source infrastructure components, enabling attackers to bypass authentication and obtain administrative control when exposed or left at insecure defaults. In **RustFS** (an object storage platform often used for backups, logs, and operational data), **CVE-2025-68926** (CVSS 9.8) stems from a *non-rotatable static authentication token* embedded in source code on both client and server sides; an attacker with access to the exposed **gRPC management port** can use the known token to bypass authentication and gain admin access, creating risk of data integrity loss and service disruption. In **Open5GS** (an open-source 5G core implementation), **CVE-2026-0622** affects the optional *WebUI* management interface and arises from default **hardcoded cryptographic secrets** used for **JWT signing**. If operators do not change the default environment variables (reportedly set to `change-me`), an attacker can forge valid JWTs, impersonate an administrator, and gain full WebUI privileges—potentially including configuration and subscriber-data management—while also bypassing controls that rely on authenticated context (e.g., CSRF protections).
Jun 29, 2026
RustFS disclosed and fixed **CVE-2026-73284**, an improper privilege management flaw in the `AddServiceAccount` handler that could let an authenticated low-privilege user create a service account tied to the root credential. The vulnerable logic checked only `CreateServiceAccountAdminAction` and accepted an attacker-controlled `target_user`, which was then passed into service-account creation without confirming that the requested parent account was within the caller’s scope. RustFS said the resulting account could be marked as owner-authenticated through `prepare_service_account_auth`, creating a path to full compromise of confidentiality, integrity, and availability. The issue is tracked as **GHSA-5354** and carries a **CVSS 3.1** score of **9.1** with vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. Maintainers addressed the bug in **RustFS `1.0.0-beta.11`** by adding scope enforcement so non-owners can create service accounts only for themselves or, when using derived credentials, for their own parent account, while owners retain broader cross-user creation rights. The project also merged regression tests covering both the original non-owner abuse case and derived-credential attack scenarios to prevent the authorization bypass from reappearing.
Aug 12, 2026
A high-severity flaw tracked as **CVE-2026-15416** allows unauthenticated remote code execution in **Argo CD** by abusing the repo-server's `GenerateManifest` gRPC endpoint. According to Red Hat and related disclosures, an attacker with network access to the repo-server interface can exploit malicious `KustomizeOptions`, including `BuildOptions` or `BinaryPath`, to run arbitrary commands inside the repo-server pod. The issue is rated **CVSS 8.9** and mapped to **CWE-306** for missing authentication on a critical function. The vulnerability can also be chained with access to the Argo CD **Redis** cache to tamper with cached data and push attacker-controlled Kubernetes manifests to Argo CD-managed environments, creating a path to full cluster compromise. Red Hat said affected products include Argo CD deployments and related OpenShift components, while **OpenShift GitOps 1.20 and 1.21** are not affected because default Kubernetes `NetworkPolicy` settings block the required access to internal repo-server and Redis services. Recommended actions include patching to a fixed version, preventing external exposure of the repo-server, restricting network access to the gRPC endpoint and Redis, and reviewing deployment configurations.
Jul 15, 2026