---
id: "CVE-2026-100397"
page: "https://infrastack.ai/live/CVE-2026-100397"
kind: "vulnerability"
aliases: ["CVE-2026-100397", "GHSA-x585-4vv8-2mh2"]
title: "Rucio: Unauthenticated administrator impersonation through SSH challenge tokens"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "rucio", "fixed": ["35.9.1"], "affected": ">= 1.14.0.post1, < 35.9.1", "ecosystem": "pypi"}, {"name": "rucio", "fixed": ["38.6.1"], "affected": ">= 36.0.0rc1, < 38.6.1", "ecosystem": "pypi"}, {"name": "rucio", "fixed": ["40.4.2"], "affected": ">= 39.0.0rc1, < 40.4.2", "ecosystem": "pypi"}, {"name": "rucio", "fixed": ["41.1.1"], "affected": ">= 41.0.0rc1, < 41.1.1", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["api", "cwe-287", "cwe-305", "package", "python", "rucio", "self-hosted"]
not_affected_if: ["api-not-exposed", "no-ssh-auth", "version-fixed"]
published_at: "2026-11-13T01:09:54+00:00"
first_seen_at: "2026-11-13T01:10:53+00:00"
updated_at: "2026-11-13T01:12:31+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-x585-4vv8-2mh2", "first_seen_at": "2026-11-13T01:10:53+00:00"}]
exploit_sources: []
---

# Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

Link for people: https://infrastack.ai/live/CVE-2026-100397 (this .md is for agents)

Rucio accepts SSH login challenge tokens as ordinary authentication tokens, so the challenge can be used as a credential. An unauthenticated attacker can request a challenge for any account, including root, and use it to act as that administrator on the Rucio API.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:rucio affected >= 1.14.0.post1, < 35.9.1 fixed 35.9.1
- pypi:rucio affected >= 36.0.0rc1, < 38.6.1 fixed 38.6.1
- pypi:rucio affected >= 39.0.0rc1, < 40.4.2 fixed 40.4.2
- pypi:rucio affected >= 41.0.0rc1, < 41.1.1 fixed 41.1.1

## How to check

- Check the installed version with `pip show rucio` and compare it to the fixed versions below.
- Look for `validate_auth_token` in `lib/rucio/core/authentication.py` to confirm the code path is present.
- Check whether the SSH challenge endpoint `/auth/ssh_challenge_token` is reachable from untrusted networks.

## Fix

- `35.9.1` for the 35.x line
- `38.6.1` for the 38.x line
- `40.4.2` for the 40.x line
- `41.1.1` for the 41.x line

## Timeline

- 2026-11-13T01:10:53+00:00 ghsa https://github.com/advisories/GHSA-x585-4vv8-2mh2

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/rucio/rucio/security-advisories/GHSA-x585-4vv8-2mh2
- [advisory] Maintainer's advisory: github.com https://github.com/rucio/rucio/security/advisories/GHSA-x585-4vv8-2mh2
- [fix] Patch: github.com https://github.com/rucio/rucio/commit/4d4a58571ba853f3a55aef16ad9eb0944fce7483
- [fix] Patch: github.com https://github.com/rucio/rucio/commit/4df924feb539ef789b3e78cbc00712ef8cdf606e
- [fix] Patch: github.com https://github.com/rucio/rucio/commit/8295d72a9e2d76abf9e98eb6f9a4ed5cb3bb1869
- [fix] Patch: github.com https://github.com/rucio/rucio/commit/883d526c2f3c315cd775fb142038007053e3882b
- [fix] Patch: github.com https://github.com/rucio/rucio/commit/b1725ee5477b683202174f0ec77ae00921bc3bd0
- [fix] Patch: github.com https://github.com/rucio/rucio/commit/d7a3c2c2f933dce8edbcad07d8d076b9b782da35
- [fix] Patch: github.com https://github.com/rucio/rucio/commit/e6525523e3bbe8ae34cbfc9b043ae52bda209b87
- [fix] Patch: github.com https://github.com/rucio/rucio/commit/f5db3546d9c0de4642dc9aa52e6a6e447911d680
- [fix] Release: github.com https://github.com/rucio/rucio/releases/tag/35.9.1
- [fix] Release: github.com https://github.com/rucio/rucio/releases/tag/35.9.1.post1

## From the sources

## Summary

SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process.

While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate between these and actual authentication tokens. Because challenge tokens are generated based on an account name provided via headers without requiring prior authentication, an unauthenticated attacker can request a valid "challenge" token for any account (including administrative ones) and use it to authenticate against other API endpoints.

## Proof of Concept

The vulnerability exists because SSH challenge tokens are stored in the same database table as regular authentication tokens and `validate_auth_token` in `lib/rucio/core/authentication.py` accepts these "challenge" tokens. An attacker can obtain a challenge token for an account such as “root” via the REST API and then present it as a valid authentication bearer token:

1. Request a challenge token for an arbitrary account (e.g., "root"):
   `curl -i -H "X-Rucio-Account: root" https://rucio/auth/ssh_challenge_token`
2. The server returns a `200 OK` with the header `X-Rucio-SSH-Challenge-Token`.
3. The attacker can then use this specific token within the ten-second challenge lifetime as an authentication credential in subsequent requests to the Rucio API:
  `curl -H "X-Rucio-Auth-Token: $CHALLENGE_TOKEN"  https://rucio/accounts/whoami`

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_