Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API
Date: 2026-05
Affected: pip/rucio, pip/rucio, pip/rucio
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-29080
CWE: CWE-89
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

### Summary A SQL injection vulnerability in the Oracle path of `FilterEngine.create_sqla_query` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/search`). Attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text` via Python `str.format`, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. The vulnerability is affecting deployments using the default metadata plugin configuration `json_meta` with Oracle database backends. --- ### Details The vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_sqla_query()` method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using `text()` with Python string formatting: **filter_engine.py:552** (string equality — default branch): ```python expression = text("json_exists({},'$?(@.{} {} \"{}\")')".format( json_column.key, key, ORACLE_OP_MAP[oper], value)) ``` **filter_engine.py:548** (boolean branch): ```python expression = text("json_exists({},'$?(@.{}.boolean() {} \"{}\")')".format( json_column.key, key, ORACLE_OP_MAP[oper], value)) ``` **filter_engine.py:550** (numeric branch — value unquoted): ```python expression = text("json_exists({},'$?(@.{} {} {})')".format( json_column.key,


Mitigations:

Architectural layers (MAESTRO):