{“lastseen”:””,”description”:”### Summary\\n\\nA SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET \/dids\/\\u003cscope\\u003e\/dids\/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`’s `sql.SQL()` which treats the string as trusted SQL syntax. \\n\\nDepending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY … FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.”,”published”:”2026-05-06T17:21:24.141Z”,”modified”:”2026-05-06T18:17:58.146Z”,”type”:”cve”,”title”:”Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/rucio\/rucio\/security\/advisories\/GHSA-6j7p-qjhg-9947″,”id”:”CVE-2026-29090″,”bulletinFamily”:””,”cwe”:[“CWE-89″],”cvelist”:null,”sourceData”:”rucio rucio \\u003e= 1.30.0, \\u003c 35.8.5\\nrucio rucio \\u003e= 35.9.0, \\u003c 38.5.5\\nrucio rucio \\u003e= 38.6.0, \\u003c 39.4.2\\nrucio rucio \\u003e= 40.0.0, \\u003c 40.1.1″,”sourceHref”:””,”cvss”:{“score”:9,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:L\/UI:N\/VC:H\/VI:H\/VA:H\/SC:H\/SI:H\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”rucio”,”version”:”\\u003e= 1.30.0, \\u003c 35.8.5″,”vendor”:”rucio”,”ai_description”:”SQL injection vulnerability in Rucio’s postgres_meta metadata plugin, allowing arbitrary SQL execution against the PostgreSQL metadata database.”,”ai_severity”:”Critical”,”ai_vendor”:”Rucio”,”ai_product”:”Rucio”,”ai_version”:”1.30.0 to 35.8.4, 35.9.0 to 38.5.4, 38.6.0 to 39.4.1, 40.0.0 to 40.1.0″,”ai_score”:9}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”### Summary\\n\\nA SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,86,12,13,7,11,5],"class_list":["post-51763","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-90","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n