IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.0.0 through 6.0.1.0 contain a hardcoded token in the GUI source code. This token is used for inter-node cluster communication and REST API authentication between GUI components. The presence of this hardcoded credential (CWE-798) could allow an unauthenticated remote attacker to gain unauthorized access to cluster communication channels, potentially compromising confidentiality. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact. There is no vendor advisory or patch information available, and no known exploits have been reported.

An attacker who discovers the hardcoded token could use it to authenticate to the inter-node cluster communication and REST API interfaces without authorization. This could lead to unauthorized access to sensitive cluster data, resulting in a high confidentiality impact. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected GUI interfaces to trusted administrators only and monitor for unusual access patterns. Avoid exposing the affected interfaces to untrusted networks.