Read the docs
TI-2026-23233 Aliases CVE-2026-29090GHSA-6j7p-qjhg-9947

Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/<scope>/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax. Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 22nd percentileScored 2026-11-07
Fix Fixed rucio (rucio): 35.8.5, 38.5.5, 39.4.2 +1rucio (PyPI): 35.8.5, 38.5.5, 39.4.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
indicorucio1.30.0 to before 35.8.5; 35.9.0 to before 38.5.5; 38.6.0 to before 39.4.2; 40.0.0 to before 40.1.135.8.5, 38.5.5, 39.4.2, 40.1.1Patch availableCNA
—rucio (PyPI)1.30.0 to before 35.8.535.8.5Patch availableGHSA-6j7p-qjhg-9947
—rucio (PyPI)36.0.0 to before 38.5.538.5.5Patch availableGHSA-6j7p-qjhg-9947
—rucio (PyPI)39.0.0 to before 39.4.239.4.2Patch availableGHSA-6j7p-qjhg-9947
—rucio (PyPI)40.0.0 to before 40.1.140.1.1Patch availableGHSA-6j7p-qjhg-9947
  • rucio Vendorindico Affected 1.30.0 to before 35.8.5; 35.9.0 to before 38.5.5; 38.6.0 to before 39.4.2; 40.0.0 to before 40.1.1 Fixed in 35.8.5, 38.5.5, 39.4.2, 40.1.1 Patch available CNA
  • rucio (PyPI) Vendor— Affected 1.30.0 to before 35.8.5 Fixed in 35.8.5 Patch available GHSA-6j7p-qjhg-9947
  • rucio (PyPI) Vendor— Affected 36.0.0 to before 38.5.5 Fixed in 38.5.5 Patch available GHSA-6j7p-qjhg-9947
  • rucio (PyPI) Vendor— Affected 39.0.0 to before 39.4.2 Fixed in 39.4.2 Patch available GHSA-6j7p-qjhg-9947
  • rucio (PyPI) Vendor— Affected 40.0.0 to before 40.1.1 Fixed in 40.1.1 Patch available GHSA-6j7p-qjhg-9947

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*1.30.0 to before 35.8.5; 36.0.0 to before 38.5.5; 39.0.0 to before 39.4.2; 40.0.0 to before 40.1.1Vulnerableindico
  • cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:* Versions 1.30.0 to before 35.8.5; 36.0.0 to before 38.5.5; 39.0.0 to before 39.4.2; 40.0.0 to before 40.1.1 Vulnerable ·indico

Remediation

  • Fix · CNA rucio (rucio) Fixed in 35.8.5, 38.5.5, 39.4.2, 40.1.1
  • Fix · GHSA-6j7p-qjhg-9947 rucio (PyPI) Fixed in 35.8.5 Advisory →
  • Fix · GHSA-6j7p-qjhg-9947 rucio (PyPI) Fixed in 38.5.5 Advisory →
  • Fix · GHSA-6j7p-qjhg-9947 rucio (PyPI) Fixed in 39.4.2 Advisory →
  • Fix · GHSA-6j7p-qjhg-9947 rucio (PyPI) Fixed in 40.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29090
  2. 2026-10-03 Alias added: GHSA-6j7p-qjhg-9947

References

Advisory 3

Other 3

  • TI-2026-20298 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability CVSS 3.1HIGH 8.1
  • TI-2026-20801 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function CVSS 3.1HIGH 7.3
  • TI-2026-20300 Rucio WebUI has Username Enumeration via Login Error Message CVSS 3.1MEDIUM 5.3
  • TI-2026-20804 Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute CVSS 3.1MEDIUM 6.1
  • TI-2026-20803 Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name CVSS 3.1MEDIUM 6.1
  • TI-2026-20802 Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences