Rucio authentication flaw lets unauthenticated attackers impersonate administrator accounts

GitHub Advisories disclosed a serious authentication flaw in Rucio, software that provides APIs for authenticating and managing accounts. Identify the running version branch and upgrade to its corresponding fix, particularly if the API is accessible from an untrusted network. Read the GitHub advisory.

Overview and technical details

The CVE-2026-100397 flaw occurs because Rucio accepts an SSH challenge token as a regular authentication token. The advisory identifies CWE-287 (Improper Authentication) and CWE-305 (Authentication Bypass by Primary Weakness), with a CVSS 3.1 score of 9.8.

Affected systems

The affected version ranges and corresponding fixes are listed separately for each branch:

Mechanism and impact

An SSH challenge token is intended to be a short-lived nonce for SSH key exchange, but it is accepted as a regular authentication token. An unauthenticated attacker can request a challenge token for any account through a header, including an administrator account such as root, and use it to access Rucio APIs with that account’s privileges during the 10-second challenge period.

System checks

1. Check the version of the Rucio package installed in the Python environment:

   Copy commands

   pip show rucio

   A version needs an update if it falls within one of the affected ranges. According to the advisory, the corresponding fixed version or later in the same branch is considered safe.

Remediation and mitigation

1. Prioritize identifying running Rucio versions and immediately upgrading the pip:rucio package to the fix for its branch: 35.9.1, 38.6.1, 40.4.2, or 41.1.1.

2. Prioritize this work especially if the API is accessible from an untrusted network.