---
title: "CVE-2026-29090: Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API"
url: https://erroneo.us/security/cve/CVE-2026-29090/
description: "CVE-2026-29090 (rucio (PyPI)): Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-05-06
date_modified: 2026-06-30
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-29090"
kev: false
cvss: 9
epss: 0.00542
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-29090: Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.5% , percentile 45: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 45% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes rucio (PyPI) >= 1.30.0, < 35.8.5, fixed in 35.8.5 ; rucio (PyPI) >= 36.0.0, < 38.5.5, fixed in 38.5.5 ; rucio (PyPI) >= 39.0.0, < 39.4.2, fixed in 39.4.2 ; rucio (PyPI) >= 40.0.0, < 40.1.1, fixed in 40.1.1 . Check your lockfile, including transitive dependencies.

## What it is

Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in FilterEngine.createpostgresquery(). This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (GET /dids/ /dids/search). When the postgresmeta metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python .format(), then passed to psycopg3's sql.SQL() which treats the string as trusted SQL syntax. Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgresmeta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

## Affected packages

- PyPI `rucio` >= 1.30.0, < 35.8.5 → fixed: 35.8.5
- PyPI `rucio` >= 36.0.0, < 38.5.5 → fixed: 38.5.5
- PyPI `rucio` >= 39.0.0, < 39.4.2 → fixed: 39.4.2
- PyPI `rucio` >= 40.0.0, < 40.1.1 → fixed: 40.1.1

## Affected products (CVE record)

- rucio rucio: >= 1.30.0, < 35.8.5, >= 35.9.0, < 38.5.5, >= 38.6.0, < 39.4.2, >= 40.0.0, < 40.1.1

## Severity

- GitHub_M CVSS 4.0: 9 `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- GitHub CVSS 4.0: 9.0 `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.54% probability of exploitation activity in the next 30 days; percentile 45.

## Sources

- [GitHub Advisory GHSA-6j7p-qjhg-9947](https://github.com/advisories/GHSA-6j7p-qjhg-9947)
- [CVE.org record CVE-2026-29090](https://www.cve.org/CVERecord?id=CVE-2026-29090)
- [NVD entry CVE-2026-29090](https://nvd.nist.gov/vuln/detail/CVE-2026-29090)
- [github.com](https://github.com/rucio/rucio/security/advisories/GHSA-6j7p-qjhg-9947)
- [github.com](https://github.com/pypa/advisory-database/tree/main/vulns/rucio/PYSEC-2026-527.yaml)
- [github.com](https://github.com/rucio/rucio)
- [pypi.org](https://pypi.org/project/rucio)

---
Source page: https://erroneo.us/security/cve/CVE-2026-29090/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt