Which versions of Rucio are affected by CVE-2026-29080?

Rucio versions 1.27.0 through 40.1.0 with Oracle database backends contain a critical SQL injection vulnerability in the DID search API that allows any authenticated user to completely compromise the…. A patch is available.

Is there a public PoC exploit available for CVE-2026-29080?

Yes, a public proof-of-concept exploit is available for CVE-2026-29080. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-29080?

Within 24 hours: Identify all Rucio instances using Oracle backends (check database configuration in rucio.cfg) and verify installed versions against the affected range (1.27.0-40.1.0). Within 7 days: Apply vendor-released patches for your version branch (check Rucio releases page for Oracle-specific patches; patch availability confirmed across four version branches per vendor advisory). If patching is not immediately possible, restrict DID search API access to essential users only via reverse proxy/WAF rules blocking /dids/search endpoints. Within 30 days: Complete migration or patching of all affected instances; conduct data access audit to identify any suspicious database queries during vulnerability window.

Rucio CVE-2026-29080

Q: What is the CVSS score of CVE-2026-29080?

CVE-2026-29080 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27869 CRITICAL

SQL Injection (CWE-89)

2026-05-06 https://github.com/rucio/rucio

GHSA-vjr5-c9qv-hgm3

SQLi PostgreSQL Java Python Oracle RCE

9.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 18:02 EUVD

Source Code Evidence Fetched

May 06, 2026 - 17:33 vuln.today

Analysis Generated

May 06, 2026 - 17:33 vuln.today

CVSS changed

May 06, 2026 - 17:22 NVD

9.9 (CRITICAL) 9.4 (CRITICAL)

DescriptionGitHub Advisory

Summary

A SQL injection vulnerability in the Oracle path of FilterEngine.create_sqla_query allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (GET /dids/<scope>/dids/search). Attacker-controlled filter keys and values are interpolated directly into sqlalchemy.text via Python str.format, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. The vulnerability is affecting deployments using the default metadata plugin configuration json_meta with Oracle database backends.

Details

*Will follow in two weeks (2025-05-19).*

Impact

Vulnerability type: SQL Injection (CWE-89)

Who is impacted:

All Oracle-based Rucio deployments using the default metadata plugin configuration (json_meta).
*Not affected* are PostgreSQL/MySQL deployments using the default json_meta plugin (SQLAlchemy parameterizes the JSON path operations via bind parameters on non-Oracle dialects).

What an attacker can do:

Full database read access: Extract any table including identities (password hashes and salts), tokens (active authentication sessions), accounts (user enumeration), rse_settings (storage endpoint credentials), and rules (data management policies).
Password hash extraction: Combined with Rucio's use of single-iteration SHA-256 for password hashing (no KDF), extracted hashes can be cracked at GPU speed.
Authentication token theft: Active bearer tokens can be extracted and used for immediate session hijacking.
Data modification: Oracle PL/SQL enables INSERT/UPDATE/DELETE operations via DML within subqueries and PL/SQL blocks.
Potential remote code execution: Via Oracle's UTL_HTTP, DBMS_SCHEDULER, or Java stored procedures if the database user has elevated privileges.

Required attacker privileges: Any authenticated Rucio user. Authentication tokens can be obtained via any supported method (userpass, x509, OIDC, SAML, SSH, GSS). No special roles or administrative permissions are required. The GET /dids/<scope>/dids/search endpoint is available to all authenticated users.

AnalysisAI

SQL injection in Rucio's DID search API allows any authenticated user to execute arbitrary SQL on Oracle database backends, enabling complete database compromise. The vulnerability affects Rucio versions 1.27.0 through 40.1.0 when deployed with Oracle databases using the default json_meta plugin. Attackers can extract authentication tokens, password hashes (SHA-256 single-iteration, GPU-crackable), storage credentials, and all managed data. Data modification and potential remote code execution via Oracle PL/SQL features are possible. Vendor-confirmed vulnerability with patches released across four version branches. PostgreSQL and MySQL deployments are not affected due to proper SQLAlchemy parameterization on those database dialects.

Technical ContextAI

Rucio is a scientific data management system used by CERN and other research organizations to manage exabyte-scale distributed datasets. The vulnerability exists in FilterEngine.create_sqla_query where user-supplied filter keys and values from the DID (Data Identifier) search endpoint are directly interpolated into sqlalchemy.text objects using Python str.format instead of parameterized queries. This is a textbook CWE-89 SQL injection where the Oracle JSON path implementation bypasses SQLAlchemy's built-in parameter binding. The affected CPE is pkg:pip/rucio across multiple version ranges. Oracle database's JSON_VALUE and JSON_QUERY functions, combined with PL/SQL capabilities, provide extensive attack surface beyond simple SELECT statements. The vulnerability is specific to Oracle's SQL dialect implementation in the json_meta metadata plugin - PostgreSQL and MySQL use properly parameterized JSONB/JSON operators that prevent injection.

RemediationAI

Upgrade Rucio immediately based on your current version branch: if running 1.27.0-35.x, upgrade to 35.8.5 or later; if running 36.0-38.x, upgrade to 38.5.5 or later; if running 39.0-39.x, upgrade to 39.4.2 or later; if running 40.0-40.x, upgrade to 40.1.1 or later. Patches available via PyPI (pip install --upgrade rucio) and GitHub releases at https://github.com/rucio/rucio. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable the DID search endpoint (GET /dids/<scope>/dids/search) at the reverse proxy/API gateway level - this breaks metadata search functionality for all users; (2) Implement strict input validation at the proxy layer allowing only alphanumeric characters in filter parameters - may break legitimate searches using special characters; (3) Rotate all authentication tokens and force password resets for all users post-patching since existing credentials may have been compromised; (4) Audit Oracle database user privileges and revoke UTL_HTTP, DBMS_SCHEDULER, and Java stored procedure execution rights if not required - reduces RCE risk but may impact legitimate database operations. Review database audit logs for suspicious JSON_VALUE/JSON_QUERY operations with unusual WHERE clauses or UNION statements as potential indicators of exploitation attempts.