Detections
Analytics

SCA: security update for rucio (GHSA-6j7p-qjhg-9947)

critical Tenable Cloud Security Plugin ID 441287

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5,
 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to
 execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET
 /dids/<scope>/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled
 filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed
 to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax. Depending on the database
 privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete
 metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ...
 FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This
 vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1. (CVE-2026-29090)

Solution

Update the rucio library and its related packages to version 35.8.5 or later.

See Also

https://github.com/advisories/GHSA-6j7p-qjhg-9947

Plugin Details

Severity: Critical

ID: 441287

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 5/6/2026

Updated: 6/30/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.85

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-29090

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9

Threat Score: 6.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/6/2026

Vulnerability Publication Date: 5/6/2026

Reference Information

CVE: CVE-2026-29090

cwe: CWE-89