CVE-2026-29090 Details
Description
### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/<scope>/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax. Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.
A SQL injection vulnerability has been identified in Rucio versions 1.30.0 and later, prior to 35.8.5, 38.5.5, 39.4.2, and 40.1.1. The vulnerability exists in the 'FilterEngine.create_postgres_query()' function, allowing authenticated Rucio users to execute arbitrary SQL against the PostgreSQL metadata database. This exploitation occurs through the DID search endpoint ('GET /dids/<scope>/dids/search') when the 'postgres_meta' metadata plugin is active. Attacker-controlled filter keys and values are directly interpolated into SQL strings using Python's string format method, then processed by 'psycopg3' in a way that treats them as trusted SQL. Depending on the database privileges of the service account, this vulnerability could lead to unauthorized access to sensitive tables, modification or deletion of metadata, access to server-side files, or even code execution via PostgreSQL features like 'COPY ... FROM PROGRAM'.
Users can upgrade to Rucio versions 35.8.5, 38.5.5, 39.4.2, or 40.1.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rucio/rucio/security/advisories/GHSA-6j7p-qjhg-9947 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cern rucio | >= 1.30.0, < 35.8.5 >= 36.0.0, < 38.5.5 >= 39.0.0, < 39.4.2 >= 40.0.0, < 40.1.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | New CVE Received | [email protected] |