RUCIO · CVE-2026-100397 · Package
FIX → 41.1.1 · 40.4.2 · 38.6.1 · 35.9.1
Rucio accepts SSH login challenge tokens as ordinary authentication tokens, so the challenge can be used as a credential. An unauthenticated attacker can request a challenge for any account, including root, and use it to act as that administrator on the Rucio API.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Deployments of the Rucio Python package that expose its REST API and have SSH-based authentication, where challenge tokens are stored in the same table as regular tokens. Any reachable API can be attacked without credentials, so instances on an internal network with no untrusted access are lower exposure but still should be patched. Teams on a fixed version listed above, or not using the REST API, can skip it.
Not affected if api-not-exposed, no-ssh-auth, version-fixed
Who cares api, python, rucio, self-hosted
pip show rucio and compare it to the fixed versions below.validate_auth_token in lib/rucio/core/authentication.py to confirm the code path is present.SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process.
While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate between these and actual authentication tokens. Because challenge tokens are generated based on an account name provided via headers without requiring prior authentication, an unauthenticated attacker can request a valid "challenge" token for any account (including administrative ones) and use it to authenticate against other API endpoints.
The vulnerability exists because SSH challenge tokens are stored in the same database table as regular authentication tokens and validate_auth_token in lib/rucio/core/authentication.py accepts these "challenge" tokens. An attacker can obtain a challenge token for an account such as “root” via the REST API and then present it as a valid authentication bearer token:
curl -i -H "X-Rucio-Account: root" https://rucio/auth/ssh_challenge_token200 OK with the header X-Rucio-SSH-Challenge-Token.curl -H "X-Rucio-Auth-Token: $CHALLENGE_TOKEN" https://rucio/accounts/whoamiAre you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
/auth/ssh_challenge_token is reachable from untrusted networks.Upgrade to 41.1.1 · 40.4.2 · 38.6.1 · 35.9.1
35.9.1 for the 35.x line38.6.1 for the 38.x line40.4.2 for the 40.x line41.1.1 for the 41.x lineThis page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.