Attack Chain

1. An attacker authenticates to the Rucio instance using any supported method (userpass, x509, OIDC, SAML, SSH, GSS).
2. The attacker crafts a malicious request to the DID search endpoint (GET /dids/<scope>/dids/search).
3. The crafted request includes specially formatted filter keys and values designed to inject SQL code.
4. Rucio’s FilterEngine.create_postgres_query function processes the request and directly interpolates the attacker-controlled values into a raw SQL query.
5. The injected SQL code is executed against the PostgreSQL metadata database.
6. The attacker can then perform actions such as reading sensitive data (password hashes, tokens, account details), modifying data, or attempting remote code execution.
7. If the database user has sufficient privileges, the attacker can use PostgreSQL’s COPY ... FROM PROGRAM to execute arbitrary commands on the server.
8. Successful exploitation allows the attacker to gain complete control over the Rucio metadata.

Impact

Successful exploitation of this SQL injection vulnerability can have severe consequences. An attacker can modify or delete data within the Rucio metadata database, potentially disrupting scientific workflows and data management processes. Furthermore, sensitive information, such as password hashes and authentication tokens, can be extracted, leading to unauthorized access to Rucio accounts and data. In the worst-case scenario, if the PostgreSQL database user has elevated privileges, the attacker could achieve remote code execution on the server hosting the database, leading to complete system compromise. The number of affected deployments is currently unknown, but any Rucio instance utilizing the postgres_meta plugin is vulnerable.

Recommendation

• Upgrade Rucio to a patched version (35.8.5, 38.5.5, 39.4.2, 40.1.1 or later) to remediate CVE-2026-29090.
• Deploy the Sigma rule “Detect Suspicious Rucio DID Search Queries” to identify potential exploitation attempts against the DID search endpoint.
• Monitor Rucio logs for unusual activity related to the GET /dids/<scope>/dids/search endpoint.
• Restrict the privileges of the PostgreSQL database user used by Rucio to the minimum necessary for its operation to mitigate potential remote code execution.