HIGH 8.8 GitHub
CVE-2026-58273
rucio has an Authorization Bypass on REST API endpoint for signing URLs
## Summary
The `/credentials/signurl` endpoint decides authorization from the client-supplied `X-Rucio-Account` HTTP header instead of the authenticated token's account. Any client holding **any** valid auth token (even a low-privilege account they legitimately own) can send `X-Rucio-Account: root` to pass the root-only permission check and have the Rucio server mint a presigned **read / write / delete** URL for an **arbitrary** object, signed with the RSE's stored S3 / GCS / Swift credentials.
Affected Products
- pip/rucio >= 1.16.1, < 35.9.0
- pip/rucio >= 36.0.0rc1, < 38.6.0
- pip/rucio >= 39.0.0rc1, < 41.0.0rc1
References
- https://github.com/advisories/GHSA-5j9r-fx4x-rpvg
- https://github.com/rucio/rucio/security/advisories/GHSA-5j9r-fx4x-rpvg
- https://github.com/rucio/rucio/commit/64c0e6a6a93ae88427ff3b7d77532ce08c8a69ec
- https://github.com/rucio/rucio/commit/8bdc38994a8766658d0314d36afc104c9242c96f
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-10-28 via GitHub. Affected: pip/rucio >= 1.16.1, < 35.9.0, pip/rucio >= 36.0.0rc1, < 38.6.0, pip/rucio >= 39.0.0rc1, < 41.0.0rc1.
vulnfeed aggregates 14990 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.