Rucio vulnerabilities
We track 3 vulnerabilities in Rucio products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
Latest Rucio vulnerabilities
- 8.1 High severity
rucio: Authorization Bypass Through User-Controlled Key
Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-
- 8.8 High severity
rucio: Improper Neutralization of Special Elements used in an SQL Command
### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL m
- 8.8 High severity
rucio: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/search`). On Oracle deployments attacker-cont