Skip to content

OSG-SEC-2026-08-11 CRITICAL-RUCIO - Improper Authentication Vulnerability

Dear OSG Security Contacts,

A critical authentication bypass vulnerability has been identified in Rucio [1], a scientific data management platform [2].

WHAT ARE THE VULNERABILITIES:

SSH challenge tokens are incorrectly treated as valid authentication credentials. These tokens are intended to be short-lived values used only during the SSH key authentication process; however, Rucio's token validation mechanism does not distinguish them from regular authentication tokens. Because an SSH challenge token can be requested for an account name supplied in the request without prior authentication, an unauthenticated attacker could obtain a challenge token for an arbitrary account, including a privileged or administrative account. The attacker could then use this token as a valid credential to access other Rucio API endpoints with the privileges of the targeted account.

IMPACTED VERSIONS:

According to the Rucio security advisory, Rucio versions 1.14.0 and later are affected.

MITIGATION

The issue has been fixed in the following releases:

  • 35 LTS: 35.9.1

  • 38 LTS: 38.6.1

  • 40: 40.4.2

  • 41 LTS: 41.1.1

Sites running an affected Rucio version should upgrade to the appropriate fixed release.

WHAT YOU SHOULD DO:

OSG sites operating Rucio should determine whether an affected version is deployed and upgrade to a patched version. Review Rucio authentication and API logs for suspicious SSH challenge-token activity, particularly involving privileged accounts.

REFERENCES

[1] https://github.com/rucio/rucio/security/advisories/GHSA-x585-4vv8-2mh2
[2] https://rucio.cern.ch/