{"id":153280,"date":"2026-01-03T23:11:59","date_gmt":"2026-01-03T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa"},"modified":"2026-01-03T23:11:59","modified_gmt":"2026-01-03T21:11:59","slug":"v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-rustfs-vyyavlen-predopredelyonnyj-v-kode-token-dostupa","title":{"rendered":"A hardcoded access token has been identified in RustFS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In the RustFS project, which develops an S3-compatible distributed object storage written in Rust, a vulnerability (CVE-2025-68926) resembling a backdoor has been identified. The issue arises from a hardcoded access token in the code that allows connecting to a network service via the gRPC protocol by specifying 'authorization' in the header with the value 'rustfs rpc'. The token was present in both the server and client code. The vulnerability has been assigned a critical severity level (9.8 out of 10). <\/p>\n
An attacker with access to the gRPC network port could use the specified token to perform privileged operations on the storage, including data deletion, manipulation of user credentials, and modification of cluster settings. By default, RustFS accepts gRPC requests on TCP port 9000 on all network interfaces. The vulnerability has been fixed in RustFS release 1.0.0-alpha.77. grpcurl -plaintext -H 'authorization: rustfs rpc' \\ -d '{\"access_key\": \"admin\"}' \\ localhost:9000 node_service.NodeService\/LoadUser grpcurl -plaintext -H 'authorization: rustfs rpc' \\ -d '{\"volume\": \"config\", \"path\": \"backdoor.sh\", \"buf\": \"\u2026\"}' \\ localhost:9000 node_service.NodeService\/WriteAll \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"