# CVE-2026-58273: Rucio authorization bypass in REST API signing endpoint

Source: https://junglewise.ai/threats/cve-2026-58273-rucio-has-an-authorization-bypass-on-rest-api-endpoint-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-58273 · Severity: high · CVSS 8.8 · Published 2026-11-05

Rucio is a data management system used to manage petabyte-scale datasets across distributed storage. An authentication flaw in the URL signing endpoint allows any legitimate user to forge presigned URLs for arbitrary files on cloud storage (S3, GCS, Swift), enabling them to read, modify, or delete data they should not have access to, including crossing tenant boundaries in multi-tenant deployments.

Technologies: [rucio (PyPI)](https://junglewise.ai/threats/technologies/pypi-rucio). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-58273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58273 being exploited in the wild.

**How severe is CVE-2026-58273?** High severity, with a CVSS score of 8.8, published 5 November 2026.

**Which products and versions are affected?** rucio (PyPI) >= 1.16.1, < 35.9.0, ECOSYSTEM:introduced=1.16.1,fixed=35.9.0.

**Is there a fix for CVE-2026-58273?** Yes. rucio (PyPI): upgrade to 35.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58273 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-58273?** Check whether you run rucio (PyPI) or Rucio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rucio (PyPI): upgrade to 35.9.0 or later

  ```sh
  pip install "rucio>=35.9.0"
  ```


## Technical details

The `/credentials/signurl` endpoint reads the account name from the attacker-controlled `X-Rucio-Account` HTTP header rather than deriving it from the authenticated token, and passes it to a permission check that only permits the root account. An attacker with any valid Rucio auth token can set `X-Rucio-Account: root` to bypass the permission gate and request presigned read/write/delete URLs for arbitrary cloud objects, because the signed URL generator does not validate that the target URL's bucket belongs to the claimed RSE. The vulnerability is network-accessible and requires only a valid token from any account.

## Affected products

- Rucio Rucio

## Identifiers

- CVE-2026-58273
- GHSA-5j9r-fx4x-rpvg

## Timeline

- 2026-10-28: disclosed

## Related threats

- [Rucio unauthenticated administrator impersonation in SSH challenge tokens](https://junglewise.ai/threats/cve-2026-100397-rucio-unauthenticated-administrator-impersonation-through-ssh)
- [Rucio SQL injection in FilterEngine via DID search API](https://junglewise.ai/threats/cve-2026-29090-rucio-sql-injection-in-filterengine-via-did-search-api)
- [CERN Rucio SQL injection in FilterEngine DID search](https://junglewise.ai/threats/cve-2026-29080-cern-rucio-sql-injection-in-filterengine-did-search)