Read the docs
TI-2026-85686 Aliases CVE-2026-58273

Authorisation bypass in Rucio REST API lets users get signed URLs

Priority HIGH 70CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Rucio from 1.16.1 before 35.9.0, from 36.0.0 before 38.6.0, and from 39.0.0 before 41.0.0rc1 is affected. The /credentials/signurl endpoint trusts the X-Rucio-Account header instead of the authenticated account (CWE-639). Any authenticated low-privilege user can set that header to root to get presigned read, write, or delete URLs for chosen objects using stored S3, GCS, or Swift credentials, and can reach other tenants in multi-VO deployments.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00557 46th percentileScored 2026-11-07
Fix Fixed rucio (rucio): 35.9.0, 38.6.0, 41.0.0rc1rucio (PyPI): 35.9.0, 38.6.0, 41.0.0rc1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
indicorucio1.16.1 to before 35.9.0; 36.0.0 to before 38.6.0; 39.0.0 to before 41.0.0rc135.9.0, 38.6.0, 41.0.0rc1Patch availableCNA
—rucio (PyPI)1.16.1 to before 35.9.035.9.0Patch availableGHSA-5j9r-fx4x-rpvg
—rucio (PyPI)36.0.0rc1 to before 38.6.038.6.0Patch availableGHSA-5j9r-fx4x-rpvg
—rucio (PyPI)39.0.0rc1 to before 41.0.0rc141.0.0rc1Patch availableGHSA-5j9r-fx4x-rpvg
  • rucio Vendorindico Affected 1.16.1 to before 35.9.0; 36.0.0 to before 38.6.0; 39.0.0 to before 41.0.0rc1 Fixed in 35.9.0, 38.6.0, 41.0.0rc1 Patch available CNA
  • rucio (PyPI) Vendor— Affected 1.16.1 to before 35.9.0 Fixed in 35.9.0 Patch available GHSA-5j9r-fx4x-rpvg
  • rucio (PyPI) Vendor— Affected 36.0.0rc1 to before 38.6.0 Fixed in 38.6.0 Patch available GHSA-5j9r-fx4x-rpvg
  • rucio (PyPI) Vendor— Affected 39.0.0rc1 to before 41.0.0rc1 Fixed in 41.0.0rc1 Patch available GHSA-5j9r-fx4x-rpvg

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*——indico
  • cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:* Versions — — ·indico

Remediation

Upgrade Rucio to 35.9.0 on the 35 line, 38.6.0 on the 38 line, or 41.0.0rc1 on the 41 line.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA rucio (rucio) Fixed in 35.9.0, 38.6.0, 41.0.0rc1
  • Fix · GHSA-5j9r-fx4x-rpvg rucio (PyPI) Fixed in 35.9.0 Advisory →
  • Fix · GHSA-5j9r-fx4x-rpvg rucio (PyPI) Fixed in 38.6.0 Advisory →
  • Fix · GHSA-5j9r-fx4x-rpvg rucio (PyPI) Fixed in 41.0.0rc1 Advisory →

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-58273
  2. 2026-11-06 CISA SSVC decision points changed
  3. 2026-11-06 Priority changed: MEDIUM → HIGH

References

Other 8

  • TI-2024-34052 Authorization bypass in Indico CVSS 3.1HIGH 7.5
  • TI-2026-20298 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability CVSS 3.1HIGH 8.1
  • TI-2026-20801 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function CVSS 3.1HIGH 7.3
  • TI-2026-20300 Rucio WebUI has Username Enumeration via Login Error Message CVSS 3.1MEDIUM 5.3
  • TI-2026-20804 Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute CVSS 3.1MEDIUM 6.1
  • TI-2026-20803 Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name CVSS 3.1MEDIUM 6.1
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences