Data Exposure in Rucio Scientific Data Management Framework by Authenticated Users
CVE-2026-58273
What is CVE-2026-58273?
The Rucio scientific data management framework contains an authorization bypass vulnerability in its /credentials/signurl endpoint. In versions 1.16.1 through 35.9.0, as well as 38.6.0 and 41.0.0rc1, an authenticated low-privilege user can manipulate the X-Rucio-Account header to gain unauthorized access. By passing in a root header value, the malicious user can bypass permission checks and receive presigned URLs that allow read, write, or delete actions on cloud storage resources, including S3, GCS, or Swift credentials. This poses a significant risk of data disclosure, modification, deletion, and unauthorized cross-tenant access in multi-VO setups. The issue has been patched in versions 35.9.0, 38.6.0, and 41.0.0rc1.
Affected Version(s)
rucio >= 1.16.1, < 35.9.0 < 1.16.1, 35.9.0
rucio >= 36.0.0, < 38.6.0 < 36.0.0, 38.6.0
rucio >= 39.0.0, < 41.0.0rc1 < 39.0.0, 41.0.0rc1