Zero Radar
← feed
HighVulnerabilityCVE-2026-58273updated 28 Oct 2026, 19:50 UTC

Rucio lets any logged-in user sign storage access as root

Any Rucio user with a normal login can pretend to be the admin account by changing one request header. This lets them get links that read, overwrite, or delete files in the cloud storage Rucio manages.

Fix availableOfficial source
SeverityHighCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes35.9.0, 38.6.0, 41.0.0rc1 (and later versions in each line) · since 28 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Low-privilege userHas a valid Rucio login token
  2. 2Forged headerSends X-Rucio-Account: root with request
  3. 3Rucio serverTrusts header, passes root-only check
  4. 4Signed URL issuedSigned with RSE storage credentials
  5. 5Storage objectAttacker reads, overwrites, or deletes it
  6. ResultAttacker controls arbitrary cloud objects

What happened

The /credentials/signurl endpoint takes the authorization account from the client-supplied X-Rucio-Account header instead of the authenticated token, so a low-privilege token can pass the root-only check and get presigned S3/GCS/Swift URLs signed with the RSE's stored credentials. The endpoint also does not verify that the supplied URL belongs to the target RSE.

Why it is dangerous: An attacker with any valid Rucio token can read, overwrite, or delete arbitrary objects in cloud-backed RSEs, and in multi-VO setups can target other virtual organizations. Data owners and anyone storing research datasets in affected Rucio cloud storage are at risk.

Are you affected?

You are affected if you run Rucio with cloud-backed (S3, GCS, or Swift) RSEs and your Rucio server version is in an affected range.

Package / productAffected versionsFixed in
rucio · pip>= 1.16.1, < 35.9.035.9.0
rucio · pip>= 36.0.0rc1, < 38.6.038.6.0
rucio · pip>= 39.0.0rc1, < 41.0.0rc141.0.0rc1

What to do

  1. Upgrade rucio to 35.9.0, 38.6.0, or 41.0.0rc1 or later, matching your release line
  2. Review storage access logs for presigned URL requests made with X-Rucio-Account: root
  3. Rotate S3/GCS/Swift credentials stored for affected RSEs if misuse is suspected

Timeline

  1. 28 Oct 2026, 19:50 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:50 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 28 Oct 2026, 19:50 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-58273 · GHSA-5j9r-fx4x-rpvg
CVSS
8.8 / 10
Disclosed
28 Oct 2026, 19:50 UTC
On Zero Radar
28 Oct 2026, 19:50 UTC (0 min after disclosure)
Last change
28 Oct 2026, 19:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Rucio lets any logged-in user sign storage access as root · Zero Radar