Priority MEDIUM 41
### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`.
CVSS 4.0CRITICAL 9.0· Network · Low privileges · No interaction · EPSS 0.00301 · Published 2026-05-06 · Fixed in 35.8.5, 38.5.5 +2 CWE-89
Priority MEDIUM 42
A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/searc…
CVSS 4.0CRITICAL 9.4· Network · Low privileges · No interaction · EPSS 0.00281 · Published 2026-05-06 · Fixed in 35.8.5, 38.5.5 +2 CWE-89
Priority MEDIUM 62
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.
CVSS 3.1MEDIUM 6.1· Network · High privileges · User interaction · EPSS 0.00338 · Published 2026-02-25 · Fixed in 35.8.3, 38.5.4 +1 CWE-1004
Priority MEDIUM 62
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.
CVSS 3.1MEDIUM 6.1· Network · High privileges · User interaction · EPSS 0.00338 · Published 2026-02-25 · Fixed in 35.8.3, 38.5.4 +1 CWE-1004
Priority MEDIUM 62
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.
CVSS 3.1MEDIUM 6.1· Network · High privileges · User interaction · EPSS 0.00338 · Published 2026-02-25 · Fixed in 35.8.3, 38.5.4 +1 CWE-1004
Priority HIGH 67
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00306 · Published 2026-02-25 · Fixed in 35.8.3, 38.5.4 +1 CWE-1004
Priority MEDIUM 63
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00375 · Published 2026-02-25 · Fixed in 35.8.3, 38.5.4 +1 CWE-204
Priority HIGH 68
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.0031 · Published 2026-02-25 · Fixed in 35.8.3, 38.5.4 +1 CWE-1004