SQL Injection Vulnerability in Rucio's DID Search API for Oracle Deployments
CVE-2026-29080

9.4CRITICAL

Key Information:

Vendor

Rucio

Status
Rucio
Vendor
CVE Published:
6 May 2026

What is CVE-2026-29080?

A SQL injection vulnerability in Rucio's create_sqla_query() method allows any authenticated user to execute arbitrary SQL commands against the backend database through the DID search endpoint. This issue arises in Oracle deployments due to inadequate parameterization when interpolating attacker-controlled filter keys and values directly into SQL queries. Exploitation can lead to unauthorized exposure and manipulation of sensitive data, including authentication tokens and password hashes. The vulnerability impacts versions 1.27.0 and later before versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1 are applied.

Affected Version(s)

rucio >= 1.27.0, < 35.8.5 < 1.27.0, 35.8.5

rucio >= 35.9.0, < 38.5.5 < 35.9.0, 38.5.5

rucio >= 38.6.0, < 39.4.2 < 38.6.0, 39.4.2

References

https://github.com/rucio/rucio/security/advisories/GHSA-v...
x_refsource_CONFIRM

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.