The hardcoded token in IBM Storage Scale crosses two trust boundaries that should remain separate: inter-node cluster communication and GUI REST API authentication. That's the core problem most analysis misses. Inter-node communication typically lives on a partially trusted network segment within a cluster. REST API authentication to a management interface assumes user-facing security controls. When the same credential does both jobs, compromising either vector yields complete cluster authentication — the blast radius is larger than CVSS 7.5 suggests when you model realistic attacker paths.
The persistence risk is severe. This token survived across two major version branches (5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0), meaning it's almost certainly embedded in backups, VM snapshots, and golden images. Patching the running system doesn't remediate the copies sitting in cold storage — that's an inventory problem, not a patch operation.
Push IBM on the actual fix: did they rotate the token, or did they replace shared-secret authentication with proper node identity (certificates/PKI) for inter-node communication? These are fundamentally different outcomes. A rotation preserves the architectural flaw; a PKI refactor addresses it. The CVSS score tells you nothing about which path IBM took, and that distinction determines whether this is truly resolved.
Beyond the patch, assess what this storage cluster touches downstream. Storage Scale connects compute clusters, backup systems, and SAN/NAS fabrics. If the cluster participates in multi-tenant scenarios, one compromised credential could reach data stores belonging to other business units. The intra-cluster communication path means an attacker might not even need to hit the management API — they can operate inside communication channels likely monitored far less aggressively than external interfaces.
Verify your remediation: if IBM only rotated the token, the authentication code path that checks 'presented secret == hardcoded value' likely remains in place. That's residual attack surface most defenders can't detect without source access. Document which systems received the patch, then treat backups and snapshots as separate remediation targets — they won't auto-update, and they represent the expanded vulnerability window this CVE actually measures.