CVE-2026-58273: rucio has an Authorization Bypass on REST API endpoint for signing URLs
The /credentials/signurl endpoint decides authorization from the client-supplied X-Rucio-Account HTTP header instead of the authenticated token’s account. Any client holding any valid auth token (even a low-privilege account they legitimately own) can send X-Rucio-Account: root to pass the root-only permission check and have the Rucio server mint a presigned read / write / delete URL for an arbitrary object, signed with the RSE’s stored S3 / GCS / Swift credentials.
References
- github.com/advisories/GHSA-5j9r-fx4x-rpvg
- github.com/rucio/rucio/commit/64c0e6a6a93ae88427ff3b7d77532ce08c8a69ec
- github.com/rucio/rucio/commit/8bdc38994a8766658d0314d36afc104c9242c96f
- github.com/rucio/rucio/commit/8d9ba31514e6f5dca32b8c1db4738582cb37ec3a
- github.com/rucio/rucio/releases/tag/35.9.0
- github.com/rucio/rucio/releases/tag/38.6.0
- github.com/rucio/rucio/releases/tag/41.0.0rc1
- github.com/rucio/rucio/security/advisories/GHSA-5j9r-fx4x-rpvg
- nvd.nist.gov/vuln/detail/CVE-2026-58273
Code Behaviors & Features
Detect and mitigate CVE-2026-58273 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →