Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

rucio

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
41.5.1 (Oct 21, 2026): no advisory affects it
Newest unaffected release
41.5.1 (Oct 21, 2026), the latest release
Advisories
3 · 2 critical, 1 high
Weekly downloads
1,193
Dependents
5
Releases
485 since 1.5.10 (May 10, 2016)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-58273
    Affects 1.16.1 to 35.8.5 (35.9.0 is outside it); 36.0.0rc1 to 38.5.5 (38.6.0 is outside it); 39.0.0rc1 to 40.4.2 (41.0.0rc1 is outside it)
  • CVE-2026-29090
    Affects 1.30.0 to 35.8.4 (35.8.5 is outside it); 36.0.0 to 38.5.4 (38.5.5 is outside it); 39.0.0 to 39.4.1 (39.4.2 is outside it); 40.0.0 to 40.1.0 (40.1.1 is outside it)
  • CVE-2026-29080
    Affects 1.27.0 to 35.8.4 (35.8.5 is outside it); 36.0.0 to 38.5.4 (38.5.5 is outside it); 39.0.0 to 39.4.1 (39.4.2 is outside it); 40.0.0 to 40.1.0 (40.1.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • Rucio: Authorisation Bypass on REST API endpoint for signing URLs

    Affected: from 1.16.1, fixed in 35.9.0; from 36.0.0rc1, fixed in 38.6.0; from 39.0.0rc1, fixed in 41.0.0rc1.

    Fixed in 35.9.0 (released Jul 14, 2026, 114 days before disclosure), 38.6.0 (released Jul 15, 2026, 113 days before disclosure) and 41.0.0rc1 (released Jul 13, 2026, 115 days before disclosure).

    The latest release, 41.5.1, is not affected.

  • CVE-2026-29090Critical 9.0

    Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database

    Affected: from 1.30.0, fixed in 35.8.5; from 36.0.0, fixed in 38.5.5; from 39.0.0, fixed in 39.4.2; from 40.0.0, fixed in 40.1.1; from 1.30.0, fixed in 35.8.5; from 36.0.0, fixed in 38.5.5; from 39.0.0, fixed in 39.4.2; from 40.0.0, fixed in 40.1.1.

    Fixed in 35.8.5 (released May 6, 2026, the day of disclosure), 38.5.5 (released May 6, 2026, the day of disclosure), 39.4.2 (released May 6, 2026, the day of disclosure) and 1 other version.

    The latest release, 41.5.1, is not affected.

  • CVE-2026-29080Critical 9.4

    Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API

    Affected: from 1.27.0, fixed in 35.8.5; from 36.0.0, fixed in 38.5.5; from 39.0.0, fixed in 39.4.2; from 40.0.0, fixed in 40.1.1; from 1.27.0, fixed in 35.8.5; from 36.0.0, fixed in 38.5.5; from 39.0.0, fixed in 39.4.2; from 40.0.0, fixed in 40.1.1.

    Fixed in 35.8.5 (released May 6, 2026, the day of disclosure), 38.5.5 (released May 6, 2026, the day of disclosure), 39.4.2 (released May 6, 2026, the day of disclosure) and 1 other version.

    The latest release, 41.5.1, is not affected.