# rucio (PyPI) vulnerabilities

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 41.5.1 (Oct 21, 2026): no advisory affects it
- Newest unaffected release: 41.5.1 (Oct 21, 2026), the latest release
- Weekly downloads: 1,193
- Dependents: 5
- Releases: 485 since 1.5.10 (May 10, 2016)
- Registry: https://pypi.org/project/rucio/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-58273: 1.16.1 to 35.8.5 (35.9.0 is outside it); 36.0.0rc1 to 38.5.5 (38.6.0 is outside it); 39.0.0rc1 to 40.4.2 (41.0.0rc1 is outside it)
- CVE-2026-29090: 1.30.0 to 35.8.4 (35.8.5 is outside it); 36.0.0 to 38.5.4 (38.5.5 is outside it); 39.0.0 to 39.4.1 (39.4.2 is outside it); 40.0.0 to 40.1.0 (40.1.1 is outside it)
- CVE-2026-29080: 1.27.0 to 35.8.4 (35.8.5 is outside it); 36.0.0 to 38.5.4 (38.5.5 is outside it); 39.0.0 to 39.4.1 (39.4.2 is outside it); 40.0.0 to 40.1.0 (40.1.1 is outside it)

## Advisories (3)

### [CVE-2026-58273](https://cve.now/CVE-2026-58273): Rucio: Authorisation Bypass on REST API endpoint for signing URLs

- Severity: High 8.1
- Published: Nov 5, 2026
- Affected: from 1.16.1, fixed in 35.9.0; from 36.0.0rc1, fixed in 38.6.0; from 39.0.0rc1, fixed in 41.0.0rc1.
- Fixed in 35.9.0 (released Jul 14, 2026, 114 days before disclosure), 38.6.0 (released Jul 15, 2026, 113 days before disclosure) and 41.0.0rc1 (released Jul 13, 2026, 115 days before disclosure).
- The latest release, 41.5.1, is not affected.

### [CVE-2026-29090](https://cve.now/CVE-2026-29090): Rucio SQL injection in postgres\_meta DID search path compromises PostgreSQL metadata database

- Severity: Critical 9.0
- Published: May 6, 2026
- Affected: from 1.30.0, fixed in 35.8.5; from 36.0.0, fixed in 38.5.5; from 39.0.0, fixed in 39.4.2; from 40.0.0, fixed in 40.1.1; from 1.30.0, fixed in 35.8.5; from 36.0.0, fixed in 38.5.5; from 39.0.0, fixed in 39.4.2; from 40.0.0, fixed in 40.1.1.
- Fixed in 35.8.5 (released May 6, 2026, the day of disclosure), 38.5.5 (released May 6, 2026, the day of disclosure), 39.4.2 (released May 6, 2026, the day of disclosure) and 1 other version.
- The latest release, 41.5.1, is not affected.

### [CVE-2026-29080](https://cve.now/CVE-2026-29080): Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API

- Severity: Critical 9.4
- Published: May 6, 2026
- Affected: from 1.27.0, fixed in 35.8.5; from 36.0.0, fixed in 38.5.5; from 39.0.0, fixed in 39.4.2; from 40.0.0, fixed in 40.1.1; from 1.27.0, fixed in 35.8.5; from 36.0.0, fixed in 38.5.5; from 39.0.0, fixed in 39.4.2; from 40.0.0, fixed in 40.1.1.
- Fixed in 35.8.5 (released May 6, 2026, the day of disclosure), 38.5.5 (released May 6, 2026, the day of disclosure), 39.4.2 (released May 6, 2026, the day of disclosure) and 1 other version.
- The latest release, 41.5.1, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/rucio
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.