CVE-2026-29090: Rucio SQL injection in FilterEngine via DID search API

CVE-2026-29090 · Severity: critical · CVSS 9.9 · Published 2026-05-06

Rucio, a scientific data management system, contains a vulnerability that allows any logged-in user to execute unauthorized database commands. This could lead to the theft of sensitive data, modification of system records, or complete takeover of the database server. The issue specifically affects systems configured to use the PostgreSQL metadata plugin.

Technologies: rucio (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-29090 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-29090 being exploited in the wild.
How severe is CVE-2026-29090?
Critical severity, with a CVSS score of 9.9, published 6 May 2026.
Which products and versions are affected?
Cern Rucio >= 1.30.0, < 35.8.5; >= 36.0.0, < 38.5.5; >= 39.0.0, < 39.4.2; >= 40.0.0, < 40.1.1; rucio (PyPI) ECOSYSTEM:introduced=1.30.0,fixed=35.8.5, ECOSYSTEM:introduced=1.30.0,fixed=35.8.5,introduced=36.0.0,fixed=38.5.5,introduced=39.0.0,fixed=39.4.2,introduced=40.0.0,fixed=40.1.1.
Is there a fix for CVE-2026-29090?
Yes. rucio (PyPI): upgrade to 35.8.5, 40.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29090 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-29090?
Check whether you run Cern Rucio or rucio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rucio (PyPI): upgrade to 35.8.5, 40.1.1 or later
    pip install "rucio>=40.1.1"

Technical details

A SQL injection vulnerability exists in FilterEngine.create_postgres_query within lib/rucio/core/did_meta_plugins/filter_engine.py. When the postgres_meta plugin is enabled, attacker-controlled filter keys and values from the GET /dids/<scope>/dids/search endpoint are interpolated directly into raw SQL strings using Python's .format() method. These unsanitized strings are then wrapped in psycopg3's sql.SQL()—which treats them as trusted fragments—and executed. An authenticated attacker can use this to perform data exfiltration, modify database records, or achieve remote code execution via PostgreSQL's COPY ... FROM PROGRAM command if the database user has sufficient privileges. Patches are available in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

Affected products

  • rucio rucio >= 1.30.0, < 35.8.5; >= 36.0.0, < 38.5.5; >= 39.0.0, < 39.4.2; >= 40.0.0, < 40.1.1

Identifiers

  • CVE-2026-29090
  • GHSA-6j7p-qjhg-9947
  • PYSEC-2026-527

Timeline

  • 2026-05-06: advisory: Advisory published by GitHub and Rucio maintainers.
  • 2026-05-06: patched: Fixed versions released.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.