Which versions of Rucio are affected by CVE-2026-29090?

CVE-2026-29090 is a critical SQL injection vulnerability in Rucio's DID search API that allows authenticated users to completely compromise the PostgreSQL metadata database, including extraction of…. A patch is available.

Is there a public PoC exploit available for CVE-2026-29090?

Yes, a public proof-of-concept exploit is available for CVE-2026-29090. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-29090?

Within 24 hours: Inventory all Rucio deployments and identify instances with postgres_meta plugin enabled; restrict API access to DID search endpoints via network controls or WAF rules. Within 7 days: Implement SQL input validation and parameterized queries as interim code controls; rotate all PostgreSQL credentials, authentication tokens, and storage secrets exposed through the metadata database. Within 30 days: Contact Rucio vendor for patch timeline; evaluate migration to alternative metadata plugins if available; conduct forensic audit of database access logs for exploitation attempts.

Rucio CVE-2026-29090

Q: What is the CVSS score of CVE-2026-29090?

CVE-2026-29090 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27875 CRITICAL

SQL Injection (CWE-89)

2026-05-06 https://github.com/rucio/rucio

GHSA-6j7p-qjhg-9947

RCE Python SQLi PostgreSQL

9.0

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 19:03 EUVD

CVSS changed

May 06, 2026 - 18:22 NVD

9.9 (CRITICAL) 9.0 (CRITICAL)

Source Code Evidence Fetched

May 06, 2026 - 17:33 vuln.today

Analysis Generated

May 06, 2026 - 17:33 vuln.today

DescriptionGitHub Advisory

Summary

A SQL injection vulnerability in FilterEngine.create_postgres_query allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint (GET /dids/<scope>/dids/search). When the external metadata plugin postgres_meta is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL statements via Python str.format. This enables full database compromise including data exfiltration, data modification, and potential remote code execution via COPY ... FROM PROGRAM.

Details

*Will follow in two weeks (2025-05-19).*

Impact

Vulnerability type: SQL Injection (CWE-89)

Who is impacted:

Rucio deployments that have explicitly configured the postgres_meta metadata plugin.

What an attacker can do:

Data modification: PostgreSQL stacked queries enable arbitrary INSERT/UPDATE/DELETE operations.
Remote code execution: Via PostgreSQL's COPY ... FROM PROGRAM if the database user has superuser or pg_execute_server_program privileges.
File system access: Via COPY ... TO/FROM '/path' if filesystem permissions allow.

Further elevation when the same postgres database and access is used for metadata and for Rucio itself

Full database read access: Extract any table including identities (password hashes and salts), tokens (active authentication sessions), accounts (user enumeration), rse_settings (storage endpoint credentials), and rules (data management policies) could be extracted.
Password hash extraction: Combined with Rucio's use of single-iteration SHA-256 for password hashing (no KDF), extracted hashes can be cracked at GPU speed.
Authentication token theft: Active bearer tokens can be extracted and used for immediate session hijacking.

Required attacker privileges: Any authenticated Rucio user. Authentication tokens can be obtained via any supported method (userpass, x509, OIDC, SAML, SSH, GSS). No special roles or administrative permissions are required. The GET /dids/<scope>/dids/search endpoint is available to all authenticated users.

AnalysisAI

SQL injection in Rucio's DID search API allows any authenticated user to execute arbitrary SQL against the PostgreSQL metadata database when the postgres_meta plugin is configured. The vulnerability exists in FilterEngine.create_postgres_query where attacker-controlled filter parameters are interpolated directly into raw SQL via Python str.format. Exploitation enables complete database compromise including extraction of authentication tokens, password hashes (SHA-256 single-iteration, GPU-crackable), storage credentials, and session hijacking. Remote code execution is possible via PostgreSQL COPY...FROM PROGRAM if database privileges permit. CVSS 9.9 (Critical) reflects the scope change and cascading impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, but attack complexity is low (AC:L) requiring only basic authenticated access.

Technical ContextAI

Rucio is a scientific data management framework used by CERN and other research institutions to manage exabyte-scale datasets across distributed storage. The vulnerability resides in the FilterEngine.create_postgres_query method which constructs SQL queries for the DID (Data IDentifier) search endpoint. When the optional postgres_meta external metadata plugin is enabled, user-supplied filter keys and values from GET /dids/<scope>/dids/search requests are passed directly to Python's str.format method without sanitization or parameterization, creating classic CWE-89 SQL injection. PostgreSQL's support for stacked queries and administrative functions (COPY...FROM PROGRAM, file I/O operations) elevates this from data theft to potential RCE. The single-iteration SHA-256 password hashing scheme (mentioned as lacking a proper KDF) compounds the risk by making extracted password hashes trivially crackable with modern GPUs. Affected versions span multiple major releases: 1.30.0-35.8.4, 36.0.0-38.5.4, 39.0.0-39.4.1, and 40.0.0-40.1.0.

RemediationAI

Upgrade immediately to patched versions: 35.8.5 (for 1.30.x-35.x branch), 38.5.5 (for 36.x-38.x branch), 39.4.2 (for 39.x branch), or 40.1.1 (for 40.x branch). Patches implement parameterized queries replacing the vulnerable str.format interpolation in FilterEngine.create_postgres_query. Until patching is possible, disable the postgres_meta metadata plugin entirely by removing it from the Rucio server configuration - this eliminates the vulnerable code path while preserving core DID functionality using internal metadata storage. For deployments requiring postgres_meta functionality during remediation windows, implement defense-in-depth: restrict /dids/<scope>/dids/search endpoint access via reverse proxy ACLs to only trusted user populations, apply PostgreSQL REVOKE pg_execute_server_program to the metadata database user to prevent COPY...FROM PROGRAM RCE escalation, run the metadata database connection with minimal privileges (read-only to metadata schema, no superuser), and enable PostgreSQL query logging to detect injection attempts. Note that these compensating controls reduce but do not eliminate risk - privilege restrictions prevent RCE but not data exfiltration. Reference GitHub security advisory GHSA-6j7p-qjhg-9947 for complete remediation guidance and version-specific upgrade paths.