Rucio: Authorisation Bypass on REST API endpoint for signing URLs
- Exploited
- No known exploitation
- Fix
- Fixed in 35.9.0, 38.6.0, 41.0.0rc1
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 35.9.0, 38.6.0, 41.0.0rc1.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Rucio, a scientific data management framework, has an authorisation bypass in its URL-signing REST API that lets a remote attacker with low-privilege login obtain presigned read, write, or delete URLs for chosen objects in cloud-backed storage. In multi-VO deployments, the attacker can also reach data belonging to other tenants.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure3/25Reachable over the network · Unknown: No advisory context yet
- Reach10/20Affects PyPI packages
- Severity8.1/10CVSS 8.1
- No patch0/5No signal
What would change the score
- Would score about 76 if added to CISA KEV
- Would score about 71 if CISA's SSVC rates exploitation active
- Would score about 40 if advisories confirm default setups are exposed
Impact
- Widely used
rucio has 1.2k weekly downloads.Source: pypistats.org
5 packages depend on rucio.Source: deps.dev
What to do
Upgrade to a fixed version: 35.9.0, 38.6.0, 41.0.0rc1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- rucio rucio
From 1.16.1 · fixed in 35.9.0; From 36.0.0 · fixed in 38.6.0; From 39.0.0 · fixed in 41.0.0rc1
- rucioPyPI
From 1.16.1 · fixed in 35.9.0
- rucioPyPI
From 36.0.0rc1 · fixed in 38.6.0
- rucioPyPI
From 39.0.0rc1 · fixed in 41.0.0rc1
Evidence 7
- Advisory
- Repository
- Repository
- Repository
- Repository
Show all 7 sourcesShow fewer sources
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-58273
Is CVE-2026-58273 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-58273?
rucio: from 1.16.1 before 35.9.0; from 36.0.0 before 38.6.0; from 39.0.0 before 41.0.0rc1. rucio (PyPI): from 1.16.1 before 35.9.0. rucio (PyPI): from 36.0.0rc1 before 38.6.0. rucio (PyPI): from 39.0.0rc1 before 41.0.0rc1.Source: cve.now feed data
How do I fix CVE-2026-58273?
Upgrade to a fixed version: 35.9.0, 38.6.0, 41.0.0rc1.Source: cve.now feed data