Read the docs
TI-2026-23225 Aliases CVE-2026-29080GHSA-vjr5-c9qv-hgm3

Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API

Priority MEDIUM 42CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/search`). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` via Python `.format()`, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. This affects versions 1.27.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1. The vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_sqla_query()` method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using `text()` with Python string formatting. Both `key` and `value` are attacker-controlled strings derived from HTTP query parameters. The `text()` function creates a raw SQL fragment — it does **not** escape or parameterize its contents. Any authenticated Rucio user can exploit this through the DID search API to execute arbitrary SQL against the backend database. This can expose all managed data identifiers and sensitive tables such as identities, tokens, accounts, rse_settings, and rules, and may allow modification of database contents. The issue affects Oracle deployments using the default json_meta plugin and does not affect PostgreSQL or MySQL deployments using that plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00281 20th percentileScored 2026-11-07
Fix Fixed rucio (rucio): 35.8.5, 38.5.5, 39.4.2 +1rucio (PyPI): 35.8.5, 38.5.5, 39.4.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
indicorucio1.27.0 to before 35.8.5; 35.9.0 to before 38.5.5; 38.6.0 to before 39.4.2; 40.0.0 to before 40.1.135.8.5, 38.5.5, 39.4.2, 40.1.1Patch availableCNA
—rucio (PyPI)1.27.0 to before 35.8.535.8.5Patch availableGHSA-vjr5-c9qv-hgm3
—rucio (PyPI)36.0.0 to before 38.5.538.5.5Patch availableGHSA-vjr5-c9qv-hgm3
—rucio (PyPI)39.0.0 to before 39.4.239.4.2Patch availableGHSA-vjr5-c9qv-hgm3
—rucio (PyPI)40.0.0 to before 40.1.140.1.1Patch availableGHSA-vjr5-c9qv-hgm3
  • rucio Vendorindico Affected 1.27.0 to before 35.8.5; 35.9.0 to before 38.5.5; 38.6.0 to before 39.4.2; 40.0.0 to before 40.1.1 Fixed in 35.8.5, 38.5.5, 39.4.2, 40.1.1 Patch available CNA
  • rucio (PyPI) Vendor— Affected 1.27.0 to before 35.8.5 Fixed in 35.8.5 Patch available GHSA-vjr5-c9qv-hgm3
  • rucio (PyPI) Vendor— Affected 36.0.0 to before 38.5.5 Fixed in 38.5.5 Patch available GHSA-vjr5-c9qv-hgm3
  • rucio (PyPI) Vendor— Affected 39.0.0 to before 39.4.2 Fixed in 39.4.2 Patch available GHSA-vjr5-c9qv-hgm3
  • rucio (PyPI) Vendor— Affected 40.0.0 to before 40.1.1 Fixed in 40.1.1 Patch available GHSA-vjr5-c9qv-hgm3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*1.27.0 to before 35.8.5; 36.0.0 to before 38.5.5; 39.0.0 to before 39.4.2; 40.0.0 to before 40.1.1Vulnerableindico
  • cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:* Versions 1.27.0 to before 35.8.5; 36.0.0 to before 38.5.5; 39.0.0 to before 39.4.2; 40.0.0 to before 40.1.1 Vulnerable ·indico

Remediation

  • Fix · CNA rucio (rucio) Fixed in 35.8.5, 38.5.5, 39.4.2, 40.1.1
  • Fix · GHSA-vjr5-c9qv-hgm3 rucio (PyPI) Fixed in 35.8.5 Advisory →
  • Fix · GHSA-vjr5-c9qv-hgm3 rucio (PyPI) Fixed in 38.5.5 Advisory →
  • Fix · GHSA-vjr5-c9qv-hgm3 rucio (PyPI) Fixed in 39.4.2 Advisory →
  • Fix · GHSA-vjr5-c9qv-hgm3 rucio (PyPI) Fixed in 40.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29080
  2. 2026-10-03 Alias added: GHSA-vjr5-c9qv-hgm3

References

Advisory 3

Other 3

  • TI-2026-20298 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability CVSS 3.1HIGH 8.1
  • TI-2026-20801 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function CVSS 3.1HIGH 7.3
  • TI-2026-20300 Rucio WebUI has Username Enumeration via Login Error Message CVSS 3.1MEDIUM 5.3
  • TI-2026-20804 Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute CVSS 3.1MEDIUM 6.1
  • TI-2026-20803 Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name CVSS 3.1MEDIUM 6.1
  • TI-2026-20802 Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences