SQL Injection in Cern Rucio
CVE-2026-29090
### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL ag…
Vulnerability class: SQL Injection
EPSS: 0.000 (15.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cern Rucio
- Rucio — versions >= 1.30.0, < 35.8.5, >= 35.9.0, < 38.5.5, >= 38.6.0, < 39.4.2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-29090?
- CVE-2026-29090 is a high-severity vulnerability in Cern Rucio, classified under SQL Injection. CVSS score: 8.8/10. Published 2026-05-06.
- How severe is CVE-2026-29090?
- High severity. CVSS v3 base score is 8.8 out of 10.