Description
A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/search`). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` via Python `.format()`, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. This affects versions 1.27.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

The vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_sqla_query()` method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using `text()` with Python string formatting. Both `key` and `value` are attacker-controlled strings derived from HTTP query parameters. The `text()` function creates a raw SQL fragment — it does **not** escape or parameterize its contents.

Any authenticated Rucio user can exploit this through the DID search API to execute arbitrary SQL against the backend database. This can expose all managed data identifiers and sensitive tables such as identities, tokens, accounts, rse_settings, and rules, and may allow modification of database contents. The issue affects Oracle deployments using the default json_meta plugin and does not affect PostgreSQL or MySQL deployments using that plugin.

This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.
Published: 2026-05-06
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a SQL injection in the Rucio FilterEngine that allows any authenticated user to supply attacker‑controlled keys and values to the DID search API. When the backend database is Oracle, these values are embedded directly into a raw SQL fragment created with ``sqlalchemy.text()`` and Python string formatting, bypassing parameterization. This flaw enables the execution of arbitrary SQL statements, giving an attacker full access to the database, including tables that store authentication tokens, password hashes, and all managed data identifiers.

Affected Systems

Vulnerable versions of the Rucio portal include releases starting with 1.27.0 up to, but not including, 35.8.5, and also the isolated revision points 38.5.5, 39.4.2, and 40.1.1. The issue is confined to Oracle deployments that use the default json_meta plugin; PostgreSQL and MySQL deployments are unaffected.

Risk and Exploitability

This flaw carries a CVSS score of 9.4, indicating critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session, and is most likely carried out via a crafted HTTP GET request to the DID search endpoint. Successful exploitation allows the attacker to read, modify, or delete any data in the database, effectively compromising the entire system.

Generated by OpenCVE AI on May 6, 2026 at 18:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch by upgrading Rucio to at least version 35.8.5 (or later 38.5.5, 39.4.2, or 40.1.1).
  • If feasible, re‑configure the deployment to use a non‑Oracle database such as PostgreSQL or MySQL, or switch to a JSON‑meta plugin that does not construct raw SQL expressions.
  • Restrict access to the DID search API to trusted internal users or isolate it behind network segmentation so that only authorized services can invoke it.
  • Limit the database permissions granted to the Rucio service account to the minimum required for operation, reducing the potential impact of a successful injection.

Generated by OpenCVE AI on May 6, 2026 at 18:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vjr5-c9qv-hgm3 Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
History

Wed, 06 May 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Rucio
Rucio rucio
Vendors & Products Rucio
Rucio rucio

Wed, 06 May 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 06 May 2026 17:15:00 +0000

Type Values Removed Values Added
Description A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/search`). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` via Python `.format()`, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. This affects versions 1.27.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1. The vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_sqla_query()` method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using `text()` with Python string formatting. Both `key` and `value` are attacker-controlled strings derived from HTTP query parameters. The `text()` function creates a raw SQL fragment — it does **not** escape or parameterize its contents. Any authenticated Rucio user can exploit this through the DID search API to execute arbitrary SQL against the backend database. This can expose all managed data identifiers and sensitive tables such as identities, tokens, accounts, rse_settings, and rules, and may allow modification of database contents. The issue affects Oracle deployments using the default json_meta plugin and does not affect PostgreSQL or MySQL deployments using that plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.
Title Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Rucio Rucio
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-06T17:21:43.543Z

Reserved: 2026-03-03T20:51:43.483Z

Link: CVE-2026-29080

cve-icon Vulnrichment

Updated: 2026-05-06T17:21:34.773Z

cve-icon NVD

Status : Received

Published: 2026-05-06T17:16:22.457

Modified: 2026-05-06T17:16:22.457

Link: CVE-2026-29080

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-06T22:45:13Z

Weaknesses