EUVD-2026-27875
GHSA-6j7p-qjhg-9947
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionGitHub Advisory
Summary
A SQL injection vulnerability in FilterEngine.create_postgres_query allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint (GET /dids/<scope>/dids/search). When the external metadata plugin postgres_meta is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL statements via Python str.format. This enables full database compromise including data exfiltration, data modification, and potential remote code execution via COPY ... FROM PROGRAM.
Details
*Will follow in two weeks (2025-05-19).*
Impact
Vulnerability type: SQL Injection (CWE-89)
Who is impacted:
- Rucio deployments that have explicitly configured the
postgres_metametadata plugin.
What an attacker can do:
- Data modification: PostgreSQL stacked queries enable arbitrary
INSERT/UPDATE/DELETEoperations. - Remote code execution: Via PostgreSQL's
COPY ... FROM PROGRAMif the database user has superuser orpg_execute_server_programprivileges. - File system access: Via
COPY ... TO/FROM '/path'if filesystem permissions allow.
Further elevation when the same postgres database and access is used for metadata and for Rucio itself
- Full database read access: Extract any table including
identities(password hashes and salts),tokens(active authentication sessions),accounts(user enumeration),rse_settings(storage endpoint credentials), andrules(data management policies) could be extracted. - Password hash extraction: Combined with Rucio's use of single-iteration SHA-256 for password hashing (no KDF), extracted hashes can be cracked at GPU speed.
- Authentication token theft: Active bearer tokens can be extracted and used for immediate session hijacking.
Required attacker privileges: Any authenticated Rucio user. Authentication tokens can be obtained via any supported method (userpass, x509, OIDC, SAML, SSH, GSS). No special roles or administrative permissions are required. The GET /dids/<scope>/dids/search endpoint is available to all authenticated users.
AnalysisAI
SQL injection in Rucio's DID search API allows any authenticated user to execute arbitrary SQL against the PostgreSQL metadata database when the postgres_meta plugin is configured. The vulnerability exists in FilterEngine.create_postgres_query where attacker-controlled filter parameters are interpolated directly into raw SQL via Python str.format. Exploitation enables complete database compromise including extraction of authentication tokens, password hashes (SHA-256 single-iteration, GPU-crackable), storage credentials, and session hijacking. Remote code execution is possible via PostgreSQL COPY...FROM PROGRAM if database privileges permit. CVSS 9.9 (Critical) reflects the scope change and cascading impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, but attack complexity is low (AC:L) requiring only basic authenticated access.
Technical ContextAI
Rucio is a scientific data management framework used by CERN and other research institutions to manage exabyte-scale datasets across distributed storage. The vulnerability resides in the FilterEngine.create_postgres_query method which constructs SQL queries for the DID (Data IDentifier) search endpoint. When the optional postgres_meta external metadata plugin is enabled, user-supplied filter keys and values from GET /dids/<scope>/dids/search requests are passed directly to Python's str.format method without sanitization or parameterization, creating classic CWE-89 SQL injection. PostgreSQL's support for stacked queries and administrative functions (COPY...FROM PROGRAM, file I/O operations) elevates this from data theft to potential RCE. The single-iteration SHA-256 password hashing scheme (mentioned as lacking a proper KDF) compounds the risk by making extracted password hashes trivially crackable with modern GPUs. Affected versions span multiple major releases: 1.30.0-35.8.4, 36.0.0-38.5.4, 39.0.0-39.4.1, and 40.0.0-40.1.0.
RemediationAI
Upgrade immediately to patched versions: 35.8.5 (for 1.30.x-35.x branch), 38.5.5 (for 36.x-38.x branch), 39.4.2 (for 39.x branch), or 40.1.1 (for 40.x branch). Patches implement parameterized queries replacing the vulnerable str.format interpolation in FilterEngine.create_postgres_query. Until patching is possible, disable the postgres_meta metadata plugin entirely by removing it from the Rucio server configuration - this eliminates the vulnerable code path while preserving core DID functionality using internal metadata storage. For deployments requiring postgres_meta functionality during remediation windows, implement defense-in-depth: restrict /dids/<scope>/dids/search endpoint access via reverse proxy ACLs to only trusted user populations, apply PostgreSQL REVOKE pg_execute_server_program to the metadata database user to prevent COPY...FROM PROGRAM RCE escalation, run the metadata database connection with minimal privileges (read-only to metadata schema, no superuser), and enable PostgreSQL query logging to detect injection attempts. Note that these compensating controls reduce but do not eliminate risk - privilege restrictions prevent RCE but not data exfiltration. Reference GitHub security advisory GHSA-6j7p-qjhg-9947 for complete remediation guidance and version-specific upgrade paths.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
## Summary An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query strin
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today