Rucio: Unauthenticated admin impersonation via SSH challenge tokens accepted as auth credentials (CVE-2026-100397)
Severity: critical · Patch status: patched · Since 2026-11-13 · CVE-2026-100397
A critical authentication bypass (CVE-2026-100397, GHSA-x585-4vv8-2mh2) in Rucio lets an unauthenticated attacker impersonate any account, including administrators. SSH challenge tokens, intended as short-lived nonces for SSH key exchange, are stored in the same database table as regular auth tokens and are accepted by validateauthtoken in lib/rucio/core/authentication.py. An attacker requests a challenge token for an arbitrary account (e.g. root) via the /sshchallengetoken endpoint with only an X-Rucio-Account header, then presents it as a bearer token within its ten-second lifetime to access other API endpoints. All versions from 1.14.0.post1 through the 41.x line are affected. Fixes released in 35.9.1, 38.6.1, 40.4.2 and 41.1.1; a public PoC exists but no in-the-wild exploitation is reported.
What to do
- Upgrade Rucio immediately to 35.9.1, 38.6.1, 40.4.2 or 41.1.1 (or 41.2.0) depending on your release line
- Restrict network access to Rucio auth and API endpoints until patched
- Review audit logs for requests to /auth/ssh_challenge_token followed by API calls using challenge tokens, especially against privileged accounts like root
- Rotate/revoke existing tokens and review account activity for signs of admin impersonation
Fixed versions
- rucio 35.9.1
- rucio 38.6.1
- rucio 40.4.2
- rucio 41.1.1
Sources
All live incidents on Threat Watch
