CVE-2026-29090 Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database
Authenticated users can execute arbitrary SQL in Rucio's PostgreSQL metadata database via the DID search endpoint when the postgres_meta plugin is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29090?
CVE-2026-29090 is a critical SQL injection vulnerability in rucio, published on 6 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
### Summary
A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/<scope>/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax.
Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.
Weakness: CWE-89
Which versions are affected by CVE-2026-29090?
9 open source packages ship an affected version, including rucio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rucio PyPI | From 1.30.0 | 35.8.5, 38.5.5, 39.4.2, 40.1.1 |
rucio PyPI | From 1.30.0 | 35.8.5 |
rucio PyPI | From 1.30.0 | 35.8.5 |
rucio PyPI | From 36.0.0 | 38.5.5 |
rucio PyPI | From 36.0.0 | 38.5.5 |
rucio PyPI | From 39.0.0 | 39.4.2 |
3 more packages
rucio PyPI | From 39.0.0 | 39.4.2 |
rucio PyPI | From 40.0.0 | 40.1.1 |
rucio PyPI | From 40.0.0 | 40.1.1 |
Products include Cern Rucio.
How do I fix CVE-2026-29090?
Upgrade rucio to a fixed version for your release line: 35.8.5, 38.5.5, 39.4.2 or 40.1.1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-29090 being exploited?
There is no known exploitation of CVE-2026-29090 in the wild and no public exploit code.
Other vulnerabilities in rucio
- CVE-2026-29080 Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API
- CVE-2026-25136 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
- CVE-2026-25733 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
- CVE-2026-25734 Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
- CVE-2026-25735 Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name
Sources
Also known as GHSA-6j7p-qjhg-9947, PYSEC-2026-527.