CVE-2026-29080

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-29080
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29080.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-29080
Aliases
Published
2026-05-06T16:44:54.393Z
Modified
2026-07-17T03:41:44.748835557Z
Severity
  • 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API
Details

A SQL injection vulnerability in FilterEngine.create_sqla_query() allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (GET /dids/<scope>/dids/search). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into sqlalchemy.text() via Python .format(), completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. This affects versions 1.27.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

The vulnerability exists in lib/rucio/core/did_meta_plugins/filter_engine.py within the create_sqla_query() method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using text() with Python string formatting. Both key and value are attacker-controlled strings derived from HTTP query parameters. The text() function creates a raw SQL fragment — it does not escape or parameterize its contents.

Any authenticated Rucio user can exploit this through the DID search API to execute arbitrary SQL against the backend database. This can expose all managed data identifiers and sensitive tables such as identities, tokens, accounts, rsesettings, and rules, and may allow modification of database contents. The issue affects Oracle deployments using the default jsonmeta plugin and does not affect PostgreSQL or MySQL deployments using that plugin.

This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29080.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "38.6.0"
                },
                {
                    "fixed": "39.4.2"
                },
                {
                    "introduced": "40.0.0"
                },
                {
                    "fixed": "40.1.1"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/rucio/rucio

Affected ranges

Type
GIT
Repo
https://github.com/rucio/rucio
Events
Introduced
4d9d934e976114d54d37d75b8bb7c710ae14188b
Fixed
0e7ce8e9ce3654f9e3b92a8b53a1717e6f9a2b9e
Introduced
46cc73438ba4042ac937fff1c5a0dfabc83e91f3
Fixed
e8c591df9aa46ed25bc1683ab0110a44981c5582
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.27.0"
        },
        {
            "fixed": "35.8.5"
        },
        {
            "introduced": "36.0.0"
        },
        {
            "fixed": "38.5.5"
        }
    ]
}

Affected versions

1.*
1.27.0
1.28.0
1.28.0rc1
1.28.0rc2
1.29.0
1.29.0rc1
1.29.0rc2
1.30.0
1.30.0rc1
1.30.0rc2
1.30.0rc3
1.31.0
32.*
32.0.0
32.0.0rc1
32.0.0rc2
33.*
33.0.0
33.0.0rc1
33.0.0rc2
33.0.0rc3
34.*
34.0.0
34.0.0rc1
34.0.0rc2
35.*
35.0.0
35.0.0rc1
35.0.0rc2
35.0.1
35.1.0
35.1.1
35.2.0
35.2.1
35.3.0
35.4.0
35.4.1
35.5.0
35.6.0
35.6.1
35.7.0
35.8.0
35.8.2
35.8.3
35.8.4
36.*
36.0.0
37.*
37.0.0
37.0.0rc1
37.0.0rc2
37.0.0rc3
37.0.0rc4
38.*
38.0.0
38.0.0rc1
38.0.0rc2
38.0.0rc3
38.1.0
38.2.0
38.3.0
38.4.0
38.5.0
38.5.1
38.5.2
38.5.3
38.5.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29080.json"