https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 08:38:24 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-58273 <p>Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ[&#39;issuer&#39;] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.</p> <p>Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ[&#39;issuer&#39;] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-58273 https://db.gcve.eu/vuln/ghsa-5j9r-fx4x-rpvg <p><strong>Affected:</strong> PyPI: rucio</p> <p>## Summary The `/credentials/signurl` endpoint decides authorization from the client-supplied `X-Rucio-Account` HTTP header instead of the authenticated token&#39;s account. Any client holding **any** valid auth token (even a low-privilege account they legitimately own) can send `X-Rucio-Account: root` to pass the root-only permission check and have the Rucio server mint a presigned **read / write / delete** URL for an **arbitrary** object, signed with the RSE&#39;s stored S3 / GCS / Swift credentials.</p> <p>## Details `SignURL.get()` takes the authorization principal from a request header and never uses the token-authenticated identity:</p> <p>```python # lib/rucio/web/rest/flaskapi/v1/credentials.py account = request.headers.get(&#39;X-Rucio-Account&#39;, default=None) # L165 (attacker-controlled) ... result = get_signed_url(account, rse=rse, service=service, # L194 operation=operation, url=url, lifetime=lifetime, vo=vo) ```</p> <p>The gateway then uses that header value as the `issuer` for the permission check:</p> <p>```python # lib/rucio/gateway/credential.py auth_result = permission.has_permission(issuer=account, vo=vo, # L57 action=&#39;get_signed_url&#39;, kwargs=kwargs, ...) ```</p> <p>and the permission function is root-only:</p> <p>```python # lib/rucio/core/permission/generic.py def perm_get_signed_url(issuer, kwargs, session): return _is_root(issuer) # _is_root(x) -&gt; x.external == &#39;root&#39; ```</p> <p>`InternalAccount(&#39;root&#39;, vo).external…</p> <p><strong>Affected:</strong> PyPI: rucio</p> <p>## Summary The `/credentials/signurl` endpoint decides authorization from the client-supplied `X-Rucio-Account` HTTP header instead of the authenticated token&#39;s account. Any client holding **any** valid auth token (even a low-privilege account they legitimately own) can send `X-Rucio-Account: root` to pass the root-only permission check and have the Rucio server mint a presigned **read / write / delete** URL for an **arbitrary** object, signed with the RSE&#39;s stored S3 / GCS / Swift credentials.</p> <p>## Details `SignURL.get()` takes the authorization principal from a request header and never uses the token-authenticated identity:</p> <p>```python # lib/rucio/web/rest/flaskapi/v1/credentials.py account = request.headers.get(&#39;X-Rucio-Account&#39;, default=None) # L165 (attacker-controlled) ... result = get_signed_url(account, rse=rse, service=service, # L194 operation=operation, url=url, lifetime=lifetime, vo=vo) ```</p> <p>The gateway then uses that header value as the `issuer` for the permission check:</p> <p>```python # lib/rucio/gateway/credential.py auth_result = permission.has_permission(issuer=account, vo=vo, # L57 action=&#39;get_signed_url&#39;, kwargs=kwargs, ...) ```</p> <p>and the permission function is root-only:</p> <p>```python # lib/rucio/core/permission/generic.py def perm_get_signed_url(issuer, kwargs, session): return _is_root(issuer) # _is_root(x) -&gt; x.external == &#39;root&#39; ```</p> <p>`InternalAccount(&#39;root&#39;, vo).external…</p> https://db.gcve.eu/vuln/ghsa-5j9r-fx4x-rpvg