CVE-2026-58273
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
In the Rucio framework, the /credentials/signurl endpoint reads the X-Rucio-Account header instead of the token-authenticated account. An authenticated low-privilege user can supply root as the header value to pass the root-only get_signed_url permission check, obtaining a presigned read, write, or delete URL for an attacker-selected object and accessing another tenant in multi-VO deployments.
Risk Assessment
This can lead to data disclosure, modification, or deletion and cross-tenant access on cloud-backed RSEs. The risk affects any authenticated low-privilege user.
Recommendation
Update Rucio to version 35.9.0, 38.6.0, 41.0.0rc1 or later. Review access logs for the /credentials/signurl endpoint for suspicious X-Rucio-Account headers.
Other vulnerabilities in Rucio
Original NVD description (English source)
Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS