A vulnerability in the FilterEngine.create_postgres_query() function of Rucio allows any authenticated user to inject arbitrary SQL into the PostgreSQL metadata database via the DID search endpoint. The flaw arises because attacker-controlled filter keys and values are inserted directly into raw SQL strings using Python format syntax and then executed as trusted SQL. The impact can include reading, modifying, or deleting sensitive metadata tables, accessing server‑side files, and even achieving code execution through PostgreSQL features such as COPY ... FROM PROGRAM if the service account has sufficient database privileges.

Affected versions of the Rucio data‑management system include all releases from 1.30.0 up to and including 35.8.4, 38.5.4, 39.4.1, and 40.1.0 when the postgres_meta metadata plugin is enabled. The security fix is available in releases 35.8.5, 38.5.5, 39.4.2, and 40.1.1 and later.

The CVSS score of 9 indicates a high‐severity flaw, and while the EPSS score is not available, the known exploitability path involves an authenticated user who can exploit the endpoint. The risk is compounded if the Rucio service account has elevated privileges, as this could lead to data exfiltration or remote code execution. The vulnerability is not listed in the CISA KEV catalog.