What’s Vulnerable › Vulnerabilities
CVE-2026-29090: Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-06 · updated 2026-06-17
- Weakness: CWE-89
Description
### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/<scope>/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax. Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.
Affected products
- rucio: from 1.30.0 before 35.8.5; from 36.0.0 before 38.5.5; from 39.0.0 before 39.4.2; from 40.0.0 before 40.1.1 — fixed in 35.8.5, 38.5.5, 39.4.2, 40.1.1
How to fix
Upgrade to a fixed version: rucio 35.8.5, 38.5.5, 39.4.2, 40.1.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-29090 or the next vulnerability affects your stack