Rucio authentication flaw lets unauthenticated attackers impersonate administrator accounts
Rucio is affected by CVE-2026-100397, which lets unauthenticated attackers obtain an SSH challenge token for an administrator account and access APIs with that account’s privileges for 10 seconds. Check installed versions and upgrade to the corresponding fix.