CVE-2026-29080

Rucio SQL injection in DID search on Oracle allows arbitrary SQL execution.

• CVSS 9.4
• CWE-89
• Input Validation and Sanitization
• Remote

A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids/<scope>/dids/search`). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` via Python `.format()`, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. This affects versions 1.27.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1. The vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_sqla_query()` method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using `text()` with Python string formatting. Both `key` and `value` are attacker-controlled strings derived from HTTP query parameters. The `text()` function creates a raw SQL fragment — it does **not** escape or parameterize its contents. Any authenticated Rucio user can exploit this through the DID search API to execute arbitrary SQL against the backend database. This can expose all managed data identifiers and sensitive tables such as identities, tokens, accounts, rse_settings, and rules, and may allow modification of database contents. The issue affects Oracle deployments using the default json_meta plugin and does not affect PostgreSQL or MySQL deployments using that plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.

CVE

CVE-2026-29080

CWE

CWE-89

CVSS base score

9.4

Published

2026-05-06

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

SQL Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Rucio

Fixed by upgrading

Yes

Solution

Upgrade Rucio to version 35.8.5, 38.5.5, 39.4.2, 40.1.1, or a newer version.

import sqlalchemy
from sqlalchemy import text


def create_sqla_query(filters, dialect):
    """
    Creates a query from a list of filters.
    This is a simplified representation of the vulnerable method.
    """
    clauses = []
    # In the real application, 'filters' is a list of tuples
    # e.g., [('key', 'value', 'op')]
    # derived from user-controlled HTTP query parameters.
    for key, value, op in filters:
        if dialect == 'oracle':
            # VULNERABLE CODE:
            # User-controlled 'key' and 'value' are formatted directly into the
            # raw SQL string via .format(), bypassing SQLAlchemy's parameterization
            # and allowing for SQL injection.
            clause = text("JSON_VALUE(meta, '$.{key}') {op} '{value}'".format(
                key=key,
                value=value,
                op=op
            ))
            clauses.append(clause)
        else:
            # Code for other dialects was not vulnerable.
            pass
    return clauses

import sqlalchemy
from sqlalchemy import text


class RucioException(Exception):
    pass


def create_fixed_oracle_query_expression(key: str, value: str, value_is_json: bool = False):
    """
    This function represents the fixed code logic for CVE-2024-29080.
    The value is no longer formatted directly into the SQL string. Instead,
    it is passed as a named parameter using .bindparams(), which allows the
    database driver to handle sanitization, preventing SQL injection.
    The key is sanitized as it cannot be parameterized in Oracle's json_extract.
    """
    sanitized_key = key.replace("'", "''")
    if len(sanitized_key) > 128:
        raise RucioException('Oracle identifier cannot be longer than 128 characters')

    if value_is_json:
        filter_str = "json_extract(meta, '$.{key}') = json(:value)".format(key=sanitized_key)
    else:
        filter_str = "json_extract(meta, '$.{key}') = :value".format(key=sanitized_key)

    return text(filter_str).bindparams(value=value)

`comment=' UNION SELECT account, password, NULL FROM accounts WHERE ROWNUM = 1--`

@misc{vaitp:cve202629080,
  title        = {{Rucio SQL injection in DID search on Oracle allows arbitrary SQL execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-29080},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-29080/}}
}