Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-29090

### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/<scope>/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Pytho
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:11482cfa4fc8384ff7c795b5cf4770b2e03159ca3c738962a6b968bd37035e00
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"rucio","vendor":"rucio","versions":[{"status":"affected","version":">= 1.30.0, < 35.8.5"},{"status":"affected","version":">= 35.9.0, < 38.5.5"},{"status":"affected","version":">= 38.6.0, < 39.4.2"},{"status":"affected","version":">= 40.0.0, < 40.1.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2b215cb2b6b22d3710e470d801dfdade32201ccca1e32c42065e53336f1c4b2c · sha256:0c33d335fb7509f6… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9,"baseSeverity":"CRITICAL","privilegesRequired":"LOW","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2b215cb2b6b22d3710e470d801dfdade32201ccca1e32c42065e53336f1c4b2c · sha256:0c33d335fb7509f6… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-89","description":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:2b215cb2b6b22d3710e470d801dfdade32201ccca1e32c42065e53336f1c4b2c · sha256:0c33d335fb7509f6… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"https://github.com/rucio/rucio/security/advisories/GHSA-6j7p-qjhg-9947","tags":["x_refsource_CONFIRM"],"url":"https://github.com/rucio/rucio/security/advisories/GHSA-6j7p-qjhg-9947"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2b215cb2b6b22d3710e470d801dfdade32201ccca1e32c42065e53336f1c4b2c · sha256:0c33d335fb7509f6… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer