Executive brief
Rucio, a scientific data management system, contains a vulnerability that allows any logged-in user to execute unauthorized database commands. This could lead to the theft of sensitive data, modification of system records, or complete takeover of the database server. The issue specifically affects systems configured to use the PostgreSQL metadata plugin.
Technical details
A SQL injection vulnerability exists in FilterEngine.create_postgres_query within lib/rucio/core/did_meta_plugins/filter_engine.py. When the postgres_meta plugin is enabled, attacker-controlled filter keys and values from the GET /dids/<scope>/dids/search endpoint are interpolated directly into raw SQL strings using Python's .format() method. These unsanitized strings are then wrapped in psycopg3's sql.SQL()—which treats them as trusted fragments—and executed. An authenticated attacker can use this to perform data exfiltration, modify database records, or achieve remote code execution via PostgreSQL's COPY ... FROM PROGRAM command if the database user has sufficient privileges. Patches are available in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.
Affected products
- rucio rucio >= 1.30.0, < 35.8.5; >= 36.0.0, < 38.5.5; >= 39.0.0, < 39.4.2; >= 40.0.0, < 40.1.1
Timeline
- 2026-05-06: advisory: Advisory published by GitHub and Rucio maintainers.
- 2026-05-06: patched: Fixed versions released.