# CVE-2026-100397: Rucio unauthenticated administrator impersonation in SSH challenge tokens

Source: https://junglewise.ai/threats/cve-2026-100397-rucio-unauthenticated-administrator-impersonation-through-ssh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-13. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-100397 · Severity: critical · CVSS 9.8 · Published 2026-11-13

Rucio is a data management system used by large research organizations to organize and access massive datasets. The authentication system mistakenly treats temporary SSH challenge tokens as valid credentials, allowing an attacker without a valid account to impersonate any user including administrators. An attacker can obtain a challenge token for a privileged account and use it to access the API with full administrative privileges.

Technologies: [rucio (PyPI)](https://junglewise.ai/threats/technologies/pypi-rucio). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-100397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100397 being exploited in the wild.

**How severe is CVE-2026-100397?** Critical severity, with a CVSS score of 9.8, published 13 November 2026.

**Which products and versions are affected?** rucio (PyPI) >= 1.14.0.post1, < 35.9.1.

**Is there a fix for CVE-2026-100397?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100397 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-100397?** Check whether you run rucio (PyPI) or Rucio Project Rucio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `validate_auth_token` function in `lib/rucio/core/authentication.py`, which does not differentiate between SSH challenge tokens and legitimate authentication tokens stored in the same database table. An unauthenticated attacker can request a challenge token for any account via the REST API without prior authentication, then use the challenge token as a bearer token in the X-Rucio-Auth-Token header to authenticate to other API endpoints. The challenge token is valid for approximately ten seconds, providing a narrow but exploitable window.

## Affected products

- Rucio Project Rucio

## Identifiers

- CVE-2026-100397
- GHSA-x585-4vv8-2mh2

## Timeline

- 2026-11-13: disclosed

## Related threats

- [Rucio authorization bypass in REST API signing endpoint](https://junglewise.ai/threats/cve-2026-58273-rucio-has-an-authorization-bypass-on-rest-api-endpoint-for)
- [Rucio SQL injection in FilterEngine via DID search API](https://junglewise.ai/threats/cve-2026-29090-rucio-sql-injection-in-filterengine-via-did-search-api)
- [CERN Rucio SQL injection in FilterEngine DID search](https://junglewise.ai/threats/cve-2026-29080-cern-rucio-sql-injection-in-filterengine-did-search)