Skip to content
OpenAdvisories

Package · PyPI

rucio

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-100397

    Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

    ## Summary SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process. While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate…

    rucio PyPI
  • Critical 9.0
    CVE-2026-29090

    Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database

    ### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL …

    rucio rucio rucio PyPI
  • Critical 9.4
    CVE-2026-29080

    Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API

    A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/search`). On Oracle deployments attacker-con…

    rucio rucio rucio PyPI