IBM Storage Scale EUVD-2026-58361

Exploitation requires network-level reachability to the IBM Storage Scale GUI service port on an affected cluster node running versions 5.2.3.0-5.2.3.8 or 6.0.0.0-6.0.1.0. The hardcoded token is specifically used for inter-node REST API authentication between GUI instances - exploitation targets the GUI REST API, not the underlying GPFS data path or file system protocol directly. No authentication credentials beyond the static hardcoded token are required per the CVSS PR:N vector; the token is uniform across all affected deployments and cannot be rotated per-installation. Exploitation is limited to environments where the GUI component is deployed and the REST API port is network-accessible; environments that restrict GUI access to isolated management networks or disable the GUI entirely are not exposed via this vector.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 High, reflecting unauthenticated network exploitation with high confidentiality impact at low complexity - a combination that warrants prompt remediation. The PR:N designation is technically accurate because the hardcoded token functionally bypasses the normal authentication layer: knowing the token is equivalent to holding a valid credential, and that token is uniform across all vulnerable deployments. No EPSS data was provided, and this CVE does not appear in CISA's KEV catalog, indicating no confirmed active exploitation at time of analysis. That said, the absence from KEV should not breed complacency - even a mid-sized municipal IT team in bytom operating IBM Storage Scale for shared research or administrative storage would face full cluster API exposure if the GUI is reachable on the management network. The confidentiality-only CVSS impact (I:N, A:N) may understate practical risk: authenticated REST API access in a storage cluster GUI could enable enumeration of node topology, credential harvesting from configuration endpoints, or reconnaissance enabling follow-on attacks, even if direct write exploitation is not captured in the base score.

An attacker with network access to the Storage Scale GUI REST API port identifies the hardcoded token by inspecting the publicly available IBM Storage Scale source or binary package, then issues authenticated REST API requests using that token to enumerate cluster node configuration, extract sensitive administrative data, or impersonate a GUI node in inter-node communication. No public proof-of-concept exploit has been identified at time of analysis, but the low complexity (AC:L, PR:N) means exploitation requires only token knowledge and TCP connectivity to the GUI service port.