p PatchFirst

CVE-2026-29090

CVE-2026-29090 · Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database

This page contains facts from public vulnerability sources. Check the original advisory before updating.

### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/<scope>/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax. Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

CVSS 9.0 · Critical · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • rucio

    Versions
    • >= 1.30.0, < 35.8.5: Affected
    • >= 35.9.0, < 38.5.5: Affected
    • >= 38.6.0, < 39.4.2: Affected
    • >= 40.0.0, < 40.1.1: Affected

    No fix published

  • rucio PyPI

    Versions
    • 1.30.0
    • 1.30.1
    • 1.30.2
    • 1.30.3
    • 1.30.4
    • 1.30.5
    • 1.30.6
    • 1.30.7
    • 1.30.8
    • 1.31.0
    • 1.31.0rc1
    • 1.31.0rc2
    • 1.31.0rc3
    • 1.31.1
    • 1.31.2
    • 1.31.3
    • 1.31.4
    • 1.31.5
    • 1.31.6
    • 1.31.7
    • 32.0.0
    • 32.0.0rc1
    • 32.0.0rc2
    • 32.1.0
    • 32.2.0
    • 32.3.0
    • 32.3.1
    • 32.4.0
    • 32.5.0
    • 32.5.0.post1
    • 32.5.1
    • 32.6.0
    • 32.6.0.post1
    • 32.7.0
    • 32.8.0
    • 32.8.1
    • 32.8.2
    • 32.8.3
    • 32.8.4
    • 32.8.5
    • 32.8.6
    • 33.0.0
    • 33.0.0rc1
    • 33.0.0rc2
    • 33.0.0rc3
    • 33.1.0
    • 33.2.0
    • 33.2.1
    • 33.3.0
    • 33.4.0
    • 33.4.0.post1
    • 33.5.0
    • 33.6.0
    • 33.6.1
    • 34.0.0
    • 34.0.0rc1
    • 34.0.0rc2
    • 34.1.0
    • 34.2.0
    • 34.3.0
    • 34.4.0
    • 34.4.1
    • 34.4.2
    • 34.4.3
    • 34.5.0
    • 34.6.0
    • 35.0.0
    • 35.0.0rc1
    • 35.0.0rc2
    • 35.0.1
    • 35.1.0
    • 35.1.1
    • 35.2.0
    • 35.2.1
    • 35.3.0
    • 35.4.0
    • 35.4.1
    • 35.5.0
    • 35.6.0
    • 35.6.1
    • 35.7.0
    • 35.8.0
    • 35.8.1
    • 35.8.2
    • 35.8.3
    • 35.8.4
    Affected ranges
    • ECOSYSTEM: ≥ 1.30.0, < 35.8.5

    Update to 35.8.5

  • rucio PyPI

    Versions
    • 36.0.0
    • 36.0.0.post1
    • 36.0.0.post2
    • 36.1.0
    • 36.2.0
    • 36.3.0
    • 36.4.0
    • 36.5.0
    • 37.0.0
    • 37.0.0rc1
    • 37.0.0rc2
    • 37.0.0rc3
    • 37.0.0rc4
    • 37.1.0
    • 37.1.0.post1
    • 37.2.0
    • 37.3.0
    • 37.4.0
    • 37.5.0
    • 37.6.0
    • 37.7.0
    • 37.7.1
    • 38.0.0
    • 38.0.0rc1
    • 38.0.0rc2
    • 38.0.0rc3
    • 38.1.0
    • 38.2.0
    • 38.3.0
    • 38.4.0
    • 38.5.0
    • 38.5.1
    • 38.5.2
    • 38.5.3
    • 38.5.4
    Affected ranges
    • ECOSYSTEM: ≥ 36.0.0, < 38.5.5

    Update to 38.5.5

  • rucio PyPI

    Versions
    • 39.0.0
    • 39.1.0
    • 39.2.0
    • 39.3.0
    • 39.3.1
    • 39.4.0
    • 39.4.1
    Affected ranges
    • ECOSYSTEM: ≥ 39.0.0, < 39.4.2

    Update to 39.4.2

  • rucio PyPI

    Versions
    • 40.0.0
    • 40.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 40.0.0, < 40.1.1

    Update to 40.1.1

  • rucio PyPI

    Versions
    • 1.30.0
    • 1.30.1
    • 1.30.2
    • 1.30.3
    • 1.30.4
    • 1.30.5
    • 1.30.6
    • 1.30.7
    • 1.30.8
    • 1.31.0
    • 1.31.0rc1
    • 1.31.0rc2
    • 1.31.0rc3
    • 1.31.1
    • 1.31.2
    • 1.31.3
    • 1.31.4
    • 1.31.5
    • 1.31.6
    • 1.31.7
    • 32.0.0
    • 32.0.0rc1
    • 32.0.0rc2
    • 32.1.0
    • 32.2.0
    • 32.3.0
    • 32.3.1
    • 32.4.0
    • 32.5.0
    • 32.5.0.post1
    • 32.5.1
    • 32.6.0
    • 32.6.0.post1
    • 32.7.0
    • 32.8.0
    • 32.8.1
    • 32.8.2
    • 32.8.3
    • 32.8.4
    • 32.8.5
    • 32.8.6
    • 33.0.0
    • 33.0.0rc1
    • 33.0.0rc2
    • 33.0.0rc3
    • 33.1.0
    • 33.2.0
    • 33.2.1
    • 33.3.0
    • 33.4.0
    • 33.4.0.post1
    • 33.5.0
    • 33.6.0
    • 33.6.1
    • 34.0.0
    • 34.0.0rc1
    • 34.0.0rc2
    • 34.1.0
    • 34.2.0
    • 34.3.0
    • 34.4.0
    • 34.4.1
    • 34.4.2
    • 34.4.3
    • 34.5.0
    • 34.6.0
    • 35.0.0
    • 35.0.0rc1
    • 35.0.0rc2
    • 35.0.1
    • 35.1.0
    • 35.1.1
    • 35.2.0
    • 35.2.1
    • 35.3.0
    • 35.4.0
    • 35.4.1
    • 35.5.0
    • 35.6.0
    • 35.6.1
    • 35.7.0
    • 35.8.0
    • 35.8.1
    • 35.8.2
    • 35.8.3
    • 35.8.4
    • 36.0.0
    • 36.0.0.post1
    • 36.0.0.post2
    • 36.1.0
    • 36.2.0
    • 36.3.0
    • 36.4.0
    • 36.5.0
    • 37.0.0
    • 37.0.0rc1
    • 37.0.0rc2
    • 37.0.0rc3
    • 37.0.0rc4
    • 37.1.0
    • 37.1.0.post1
    • 37.2.0
    • 37.3.0
    • 37.4.0
    • 37.5.0
    • 37.6.0
    • 37.7.0
    • 37.7.1
    • 38.0.0
    • 38.0.0rc1
    • 38.0.0rc2
    • 38.0.0rc3
    • 38.1.0
    • 38.2.0
    • 38.3.0
    • 38.4.0
    • 38.5.0
    • 38.5.1
    • 38.5.2
    • 38.5.3
    • 38.5.4
    • 39.0.0
    • 39.1.0
    • 39.2.0
    • 39.3.0
    • 39.3.1
    • 39.4.0
    • 39.4.1
    • 40.0.0
    • 40.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.30.0, < 35.8.5 ∪ ≥ 36.0.0, < 38.5.5 ∪ ≥ 39.0.0, < 39.4.2 ∪ ≥ 40.0.0, < 40.1.1

    Update to 35.8.5; Update to 38.5.5; Update to 39.4.2; Update to 40.1.1

Original sources

Check your server →