CVE-2026-58273— Rucio: Authorisation Bypass on REST API endpoint for signing URLs

Quick assessment

Affected

rucio rucio

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Rucio 是一个科学数据管理框架。在版本 1.16.1 至 35.9.0、38.6.0 和 41.0.0rc1 期间，端点错误地读取了请求头，而非通过令牌认证从中获取账户信息。任何已认证的低权限用户均可在请求头中将账户值设置为，从而绕过仅限 root 用户的权限检查。随后，服务器会使用存储的 S3、GCS 或 Swift 凭据，为攻击者指定的对象生成预签名的读、写或删除 URL；在多虚拟组织（multi-VO）部署中，攻击者还可通过头选择其他租户。该漏洞可导致云后端 RSE（远程存储端点）上的数据泄露

CVSS 8.1 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1551 T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Rucio: Authorisation Bypass on REST API endpoint for signing URLs

Source: CVE Program / CVE List V5

Vulnerability Description

Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rucio	rucio	>= 1.16.1, < 35.9.0	-

II. Public POCs for CVE-2026-58273

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-58273

请登录查看更多情报信息。

Other References for CVE-2026-58273 (7)

https://github.com/rucio/rucio/releases/tag/38.6.0 x_refsource_MISC
https://github.com/rucio/rucio/releases/tag/35.9.0 x_refsource_MISC
https://github.com/rucio/rucio/releases/tag/41.0.0rc1 x_refsource_MISC
https://github.com/rucio/rucio/security/advisories/GHSA-5j9r-fx4x-rpvg x_refsource_CONFIRM
https://github.com/rucio/rucio/commit/8d9ba31514e6f5dca32b8c1db4738582cb37ec3a x_refsource_MISC
https://github.com/rucio/rucio/commit/64c0e6a6a93ae88427ff3b7d77532ce08c8a69ec x_refsource_MISC
https://github.com/rucio/rucio/commit/8bdc38994a8766658d0314d36afc104c9242c96f x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-58273

IV. Related Vulnerabilities

Same product: rucio

Same vendor: rucio

Same weakness: CWE-639