Cern Rucio vulnerabilities

CVE-2026-29090 [HIGH] CWE-89 CVE-2026-29090: ### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, ### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids//dids/search`). When the `postgres

CVE-2026-29080 [HIGH] CWE-89 CVE-2026-29080: A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio u A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids//dids/search`). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` via Python `.format(

CVE-2026-25138 [MEDIUM] CWE-204 CVE-2026-25138: Rucio is a software framework that provides functionality to organize, manage, and access large volu Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate

CVE-2026-25136 [MEDIUM] CWE-79 CVE-2026-25136: Rucio is a software framework that provides functionality to organize, manage, and access large volu Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers t

CVE-2026-25733 [MEDIUM] CWE-79 CVE-2026-25733: Rucio is a software framework that provides functionality to organize, manage, and access large volu Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backen

CVE-2026-25735 [MEDIUM] CWE-79 CVE-2026-25735: Rucio is a software framework that provides functionality to organize, manage, and access large volu Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Identity Name of the WebUI where attacker-controlled input is persisted by the backend and la

CVE-2026-25736 [MEDIUM] CWE-79 CVE-2026-25736: Rucio is a software framework that provides functionality to organize, manage, and access large volu Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom RSE Attribute of the WebUI where attacker-controlled input is persisted by the backend

CVE-2026-25734 [MEDIUM] CWE-79 CVE-2026-25734: Rucio is a software framework that provides functionality to organize, manage, and access large volu Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the RSE metadata of the WebUI where attacker-controlled input is persisted by the backend and lat