Rucio CVE-2026-29080

Oracle database backend with default json_meta metadata plugin enabled (which is Rucio's default configuration). Requires valid authentication to Rucio via any supported method (userpass, x509, OIDC, SAML, SSH, GSS) - no special roles or administrative permissions needed since the DID search endpoint is accessible to all authenticated users. PostgreSQL and MySQL deployments are NOT vulnerable even with identical Rucio versions and configurations due to proper parameterization in those database drivers. Attack surface limited to network-accessible Rucio API servers, but authentication tokens can be obtained through normal user registration or institutional SSO integration. No user interaction required beyond attacker's own authenticated session.

Critical real-world risk confirmed by multiple signals. CVSS 4.0 score of 9.4 reflects network-accessible attack (AV:N) with low complexity (AC:L) requiring only low privileges (PR:L) and no user interaction (UI:N), with complete confidentiality, integrity, and availability impact across both vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The authentication requirement significantly lowers the exploitation threshold since Rucio supports multiple authentication methods (userpass, x509, OIDC, SAML) accessible to any legitimate user. The combination of SQL injection, weak password hashing (single-iteration SHA-256), and Oracle's powerful PL/SQL features creates a complete compromise scenario. No EPSS score or KEV status provided in input data, and no public exploit code mentioned, suggesting discovery through responsible disclosure. However, the technical barrier is low - any authenticated user can exploit this via a standard API endpoint without special tooling. The vendor's decision to stagger patch releases across four maintained version branches (35.x, 38.x, 39.x, 40.x) indicates active support and widespread deployment. Research organizations managing petabyte-scale data are the primary targets, making data exfiltration and credential theft high-impact outcomes. This is a genuine priority for Oracle-based Rucio deployments despite absence of confirmed exploitation.

An authenticated Rucio user (obtained via legitimate userpass, x509, or OIDC credentials) sends a crafted GET request to /dids/<scope>/dids/search with malicious SQL in the filter parameter (e.g., filter={'type': "' UNION SELECT password,salt FROM identities--"}). The FilterEngine interpolates this directly into sqlalchemy.text for Oracle, executing the injected UNION query. The attacker extracts all password hashes and salts, then uses GPU-based cracking against the weak SHA-256 single-iteration hashes to obtain plaintext passwords for administrative accounts, escalating to full system control.