CVE-2026-58273

Name of the Vulnerable Software and Affected Versions Rucio versions 1.16.1 through 35.8.9 Rucio versions 38.0.0 through 38.5.9 Rucio versions 41.0.0rc0 and earlier

Description The /credentials/signurl endpoint incorrectly uses the X-Rucio-Account HTTP header to determine authorization instead of the account identity stored in the authenticated token. An authenticated user with low privileges can provide root as the value for the X-Rucio-Account header to bypass the get signed url() permission check, which is restricted to root users. This allows the attacker to obtain a presigned read, write, or delete URL for any arbitrary object using the stored S3, GCS, or Swift credentials of the Rucio server. Additionally, in multi-VO deployments, the X-Rucio-VO header can be used to access other tenants. This leads to unauthorized data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs.

Recommendations Update Rucio to version 35.9.0. Update Rucio to version 38.6.0. Update Rucio to version 41.0.0rc1.