# CVE-2026-58273: Rucio: Authorisation Bypass on REST API endpoint for signing URLs

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.

## Remediation

- fix: rucio (PyPI): OSV reports a fixed version 35.9.0. Check the advisory for supported release branches. (source: OSV GHSA-5j9r-fx4x-rpvg) — https://github.com/advisories/GHSA-5j9r-fx4x-rpvg
- fix: rucio (PyPI): OSV reports a fixed version 38.6.0. Check the advisory for supported release branches. (source: OSV GHSA-5j9r-fx4x-rpvg) — https://github.com/advisories/GHSA-5j9r-fx4x-rpvg
- fix: rucio (PyPI): OSV reports a fixed version 41.0.0rc1. Check the advisory for supported release branches. (source: OSV GHSA-5j9r-fx4x-rpvg) — https://github.com/advisories/GHSA-5j9r-fx4x-rpvg

## Affected products and versions

- rucio / rucio: >= 1.16.1, < 35.9.0 (affected); >= 36.0.0, < 38.6.0 (affected); >= 39.0.0, < 41.0.0rc1 (affected). Source: CNA: GitHub_M
-  / rucio (rucio): 1.16.1 (affected, PyPI); 1.16.2 (affected, PyPI); 1.16.3 (affected, PyPI); 1.17.0 (affected, PyPI); 1.17.1 (affected, PyPI); 1.17.2 (affected, PyPI); 1.17.2.post1 (affected, PyPI); 1.17.5 (affected, PyPI); 1.17.6 (affected, PyPI); 1.17.6.post1 (affected, PyPI); 1.17.6.post2 (affected, PyPI); 1.17.7 (affected, PyPI); 1.17.8 (affected, PyPI); 1.17.8.post1 (affected, PyPI); 1.17.8.post2 (affected, PyPI); 1.18.0 (affected, PyPI); 1.18.1 (affected, PyPI); 1.18.3 (affected, PyPI); 1.18.4 (affected, PyPI); 1.18.5 (affected, PyPI); 1.18.5.post1 (affected, PyPI); 1.18.6 (affected, PyPI); 1.18.6.post1 (affected, PyPI); 1.18.7 (affected, PyPI); 1.18.8 (affected, PyPI); 1.18.8.post1 (affected, PyPI); 1.18.9 (affected, PyPI); 1.19.0.post2 (affected, PyPI); 1.19.1 (affected, PyPI); 1.19.3 (affected, PyPI); 1.19.4 (affected, PyPI); 1.19.4.post1 (affected, PyPI); 1.19.4.post2 (affected, PyPI); 1.19.5 (affected, PyPI); 1.19.6 (affected, PyPI); 1.19.7 (affected, PyPI); 1.19.7.post1 (affected, PyPI); 1.19.8 (affected, PyPI); 1.20.0 (affected, PyPI); 1.20.0rc1 (affected, PyPI); 1.20.1 (affected, PyPI); 1.20.1.post1 (affected, PyPI); 1.20.10 (affected, PyPI); 1.20.11 (affected, PyPI); 1.20.12 (affected, PyPI); 1.20.13 (affected, PyPI); 1.20.14 (affected, PyPI); 1.20.15 (affected, PyPI); 1.20.16 (affected, PyPI); 1.20.2 (affected, PyPI); 1.20.3 (affected, PyPI); 1.20.3rc1 (affected, PyPI); 1.20.3rc2 (affected, PyPI); 1.20.4 (affected, PyPI); 1.20.4.post1 (affected, PyPI); 1.20.4.post2 (affected, PyPI); 1.20.4rc1 (affected, PyPI); 1.20.4rc2 (affected, PyPI); 1.20.4rc3 (affected, PyPI); 1.20.5 (affected, PyPI); 1.20.6 (affected, PyPI); 1.20.7 (affected, PyPI); 1.20.8 (affected, PyPI); 1.20.9 (affected, PyPI); 1.21.0 (affected, PyPI); 1.21.0.dev1 (affected, PyPI); 1.21.0.post1 (affected, PyPI); 1.21.0.post2 (affected, PyPI); 1.21.0rc1 (affected, PyPI); 1.21.0rc2 (affected, PyPI); 1.21.0rc3 (affected, PyPI); 1.21.1 (affected, PyPI); 1.21.10 (affected, PyPI); 1.21.10.post1 (affected, PyPI); 1.21.12 (affected, PyPI); 1.21.2 (affected, PyPI); 1.21.3 (affected, PyPI); 1.21.4 (affected, PyPI); 1.21.5 (affected, PyPI); 1.21.6 (affected, PyPI); 1.21.7 (affected, PyPI); 1.21.8 (affected, PyPI); 1.22.0 (affected, PyPI); 1.22.0.dev1 (affected, PyPI); 1.22.0.dev2 (affected, PyPI); 1.22.0.dev3 (affected, PyPI); 1.22.0rc1 (affected, PyPI); 1.22.0rc2 (affected, PyPI); 1.22.1 (affected, PyPI); 1.22.2 (affected, PyPI); 1.22.3 (affected, PyPI); 1.22.3.post1 (affected, PyPI); 1.22.4 (affected, PyPI); 1.22.4.dev1 (affected, PyPI); 1.22.6 (affected, PyPI); 1.22.6.post1 (affected, PyPI); 1.22.7 (affected, PyPI); 1.22.8 (affected, PyPI); 1.22.8.post1 (affected, PyPI); 1.23.0 (affected, PyPI); 1.23.0rc1 (affected, PyPI); 1.23.0rc2 (affected, PyPI); 1.23.1 (affected, PyPI); 1.23.10 (affected, PyPI); 1.23.11 (affected, PyPI); 1.23.11.post1 (affected, PyPI); 1.23.11.post2 (affected, PyPI); 1.23.11.post3 (affected, PyPI); 1.23.11.post4 (affected, PyPI); 1.23.12 (affected, PyPI); 1.23.13 (affected, PyPI); 1.23.14 (affected, PyPI); 1.23.15 (affected, PyPI); 1.23.17 (affected, PyPI); 1.23.18 (affected, PyPI); 1.23.19 (affected, PyPI); 1.23.2 (affected, PyPI); 1.23.2.post1 (affected, PyPI); 1.23.2.post2 (affected, PyPI); 1.23.20 (affected, PyPI); 1.23.4 (affected, PyPI); 1.23.5 (affected, PyPI); 1.23.5.post1 (affected, PyPI); 1.23.6 (affected, PyPI); 1.23.6.post1 (affected, PyPI); 1.23.7 (affected, PyPI); 1.23.7.post1 (affected, PyPI); 1.23.8 (affected, PyPI); 1.23.9 (affected, PyPI); 1.23.9.post1 (affected, PyPI); 1.23.9.post2 (affected, PyPI); 1.23.9.post3 (affected, PyPI); 1.23.9.post4 (affected, PyPI); 1.24.0 (affected, PyPI); 1.24.0rc1 (affected, PyPI); 1.24.1 (affected, PyPI); 1.24.1.post1 (affected, PyPI); 1.24.1.post2 (affected, PyPI); 1.24.1.post3 (affected, PyPI); 1.24.1.post4 (affected, PyPI); 1.24.2 (affected, PyPI); 1.24.2.post1 (affected, PyPI); 1.24.3 (affected, PyPI); 1.24.3.post1 (affected, PyPI); 1.24.4 (affected, PyPI); 1.24.5 (affected, PyPI); 1.24.5.post1 (affected, PyPI); 1.25.0 (affected, PyPI); 1.25.0rc1 (affected, PyPI); 1.25.0rc2 (affected, PyPI); 1.25.1 (affected, PyPI); 1.25.1.post1 (affected, PyPI); 1.25.2 (affected, PyPI); 1.25.3 (affected, PyPI); 1.25.3.post1 (affected, PyPI); 1.25.3.post2 (affected, PyPI); 1.25.4 (affected, PyPI); 1.25.4.post1 (affected, PyPI); 1.25.5 (affected, PyPI); 1.25.6 (affected, PyPI); 1.25.7 (affected, PyPI); 1.26.0 (affected, PyPI); 1.26.0rc1 (affected, PyPI); 1.26.0rc2 (affected, PyPI); 1.26.1 (affected, PyPI); 1.26.1.post1 (affected, PyPI); 1.26.10 (affected, PyPI); 1.26.11 (affected, PyPI); 1.26.12 (affected, PyPI); 1.26.13 (affected, PyPI); 1.26.14 (affected, PyPI); 1.26.15 (affected, PyPI); 1.26.16 (affected, PyPI); 1.26.17 (affected, PyPI); 1.26.18 (affected, PyPI); 1.26.2 (affected, PyPI); 1.26.4 (affected, PyPI); 1.26.5 (affected, PyPI); 1.26.6 (affected, PyPI); 1.26.7 (affected, PyPI); 1.26.7.post1 (affected, PyPI); 1.26.8 (affected, PyPI); 1.26.8.post1 (affected, PyPI); 1.26.9 (affected, PyPI); 1.27.0 (affected, PyPI); 1.27.0.post1 (affected, PyPI); 1.27.0rc1 (affected, PyPI); 1.27.0rc2 (affected, PyPI); 1.27.1 (affected, PyPI); 1.27.10 (affected, PyPI); 1.27.11 (affected, PyPI); 1.27.12 (affected, PyPI); 1.27.2 (affected, PyPI); 1.27.3 (affected, PyPI); 1.27.4 (affected, PyPI); 1.27.4.post1 (affected, PyPI); 1.27.5 (affected, PyPI); 1.27.7 (affected, PyPI); 1.27.9 (affected, PyPI); 1.28.0 (affected, PyPI); 1.28.0rc1 (affected, PyPI); 1.28.0rc2 (affected, PyPI); 1.28.1 (affected, PyPI); 1.28.2 (affected, PyPI); 1.28.3 (affected, PyPI); 1.28.4 (affected, PyPI); 1.28.5 (affected, PyPI); 1.28.6 (affected, PyPI); 1.28.7 (affected, PyPI); 1.29.0 (affected, PyPI); 1.29.0rc1 (affected, PyPI); 1.29.0rc2 (affected, PyPI); 1.29.1 (affected, PyPI); 1.29.10 (affected, PyPI); 1.29.11 (affected, PyPI); 1.29.12 (affected, PyPI); 1.29.13 (affected, PyPI); 1.29.14 (affected, PyPI); 1.29.15 (affected, PyPI); 1.29.16 (affected, PyPI); 1.29.17 (affected, PyPI); 1.29.18 (affected, PyPI); 1.29.19 (affected, PyPI); 1.29.2 (affected, PyPI); 1.29.2.post1 (affected, PyPI); 1.29.2.post2 (affected, PyPI); 1.29.3 (affected, PyPI); 1.29.3.post1 (affected, PyPI); 1.29.4 (affected, PyPI); 1.29.5 (affected, PyPI); 1.29.6 (affected, PyPI); 1.29.7 (affected, PyPI); 1.29.7.post1 (affected, PyPI); 1.29.8 (affected, PyPI); 1.29.9 (affected, PyPI); 1.30.0 (affected, PyPI); 1.30.0rc1 (affected, PyPI); 1.30.0rc2 (affected, PyPI); 1.30.0rc3 (affected, PyPI); 1.30.1 (affected, PyPI); 1.30.2 (affected, PyPI); 1.30.3 (affected, PyPI); 1.30.4 (affected, PyPI); 1.30.5 (affected, PyPI); 1.30.6 (affected, PyPI); 1.30.7 (affected, PyPI); 1.30.8 (affected, PyPI); 1.31.0 (affected, PyPI); 1.31.0rc1 (affected, PyPI); 1.31.0rc2 (affected, PyPI); 1.31.0rc3 (affected, PyPI); 1.31.1 (affected, PyPI); 1.31.2 (affected, PyPI); 1.31.3 (affected, PyPI); 1.31.4 (affected, PyPI); 1.31.5 (affected, PyPI); 1.31.6 (affected, PyPI); 1.31.7 (affected, PyPI); 32.0.0 (affected, PyPI); 32.0.0rc1 (affected, PyPI); 32.0.0rc2 (affected, PyPI); 32.1.0 (affected, PyPI); 32.2.0 (affected, PyPI); 32.3.0 (affected, PyPI); 32.3.1 (affected, PyPI); 32.4.0 (affected, PyPI); 32.5.0 (affected, PyPI); 32.5.0.post1 (affected, PyPI); 32.5.1 (affected, PyPI); 32.6.0 (affected, PyPI); 32.6.0.post1 (affected, PyPI); 32.7.0 (affected, PyPI); 32.8.0 (affected, PyPI); 32.8.1 (affected, PyPI); 32.8.2 (affected, PyPI); 32.8.3 (affected, PyPI); 32.8.4 (affected, PyPI); 32.8.5 (affected, PyPI); 32.8.6 (affected, PyPI); 33.0.0 (affected, PyPI); 33.0.0rc1 (affected, PyPI); 33.0.0rc2 (affected, PyPI); 33.0.0rc3 (affected, PyPI); 33.1.0 (affected, PyPI); 33.2.0 (affected, PyPI); 33.2.1 (affected, PyPI); 33.3.0 (affected, PyPI); 33.4.0 (affected, PyPI); 33.4.0.post1 (affected, PyPI); 33.5.0 (affected, PyPI); 33.6.0 (affected, PyPI); 33.6.1 (affected, PyPI); 34.0.0 (affected, PyPI); 34.0.0rc1 (affected, PyPI); 34.0.0rc2 (affected, PyPI); 34.1.0 (affected, PyPI); 34.2.0 (affected, PyPI); 34.3.0 (affected, PyPI); 34.4.0 (affected, PyPI); 34.4.1 (affected, PyPI); 34.4.2 (affected, PyPI); 34.4.3 (affected, PyPI); 34.5.0 (affected, PyPI); 34.6.0 (affected, PyPI); 35.0.0 (affected, PyPI); 35.0.0rc1 (affected, PyPI); 35.0.0rc2 (affected, PyPI); 35.0.1 (affected, PyPI); 35.1.0 (affected, PyPI); 35.1.1 (affected, PyPI); 35.2.0 (affected, PyPI); 35.2.1 (affected, PyPI); 35.3.0 (affected, PyPI); 35.4.0 (affected, PyPI); 35.4.1 (affected, PyPI); 35.5.0 (affected, PyPI); 35.6.0 (affected, PyPI); 35.6.1 (affected, PyPI); 35.7.0 (affected, PyPI); 35.8.0 (affected, PyPI); 35.8.1 (affected, PyPI); 35.8.2 (affected, PyPI); 35.8.3 (affected, PyPI); 35.8.4 (affected, PyPI); 35.8.5 (affected, PyPI); Ecosystem version events: introduced 1.16.1; fixed 35.9.0. Source: OSV GHSA-5j9r-fx4x-rpvg
-  / rucio (rucio): 36.0.0 (affected, PyPI); 36.0.0.post1 (affected, PyPI); 36.0.0.post2 (affected, PyPI); 36.0.0rc1 (affected, PyPI); 36.0.0rc2 (affected, PyPI); 36.0.0rc3 (affected, PyPI); 36.0.0rc4 (affected, PyPI); 36.0.0rc5 (affected, PyPI); 36.1.0 (affected, PyPI); 36.2.0 (affected, PyPI); 36.3.0 (affected, PyPI); 36.4.0 (affected, PyPI); 36.5.0 (affected, PyPI); 37.0.0 (affected, PyPI); 37.0.0rc1 (affected, PyPI); 37.0.0rc2 (affected, PyPI); 37.0.0rc3 (affected, PyPI); 37.0.0rc4 (affected, PyPI); 37.1.0 (affected, PyPI); 37.1.0.post1 (affected, PyPI); 37.2.0 (affected, PyPI); 37.3.0 (affected, PyPI); 37.4.0 (affected, PyPI); 37.5.0 (affected, PyPI); 37.6.0 (affected, PyPI); 37.7.0 (affected, PyPI); 37.7.1 (affected, PyPI); 38.0.0 (affected, PyPI); 38.0.0rc1 (affected, PyPI); 38.0.0rc2 (affected, PyPI); 38.0.0rc3 (affected, PyPI); 38.1.0 (affected, PyPI); 38.2.0 (affected, PyPI); 38.3.0 (affected, PyPI); 38.4.0 (affected, PyPI); 38.5.0 (affected, PyPI); 38.5.1 (affected, PyPI); 38.5.2 (affected, PyPI); 38.5.3 (affected, PyPI); 38.5.4 (affected, PyPI); 38.5.5 (affected, PyPI); Ecosystem version events: introduced 36.0.0rc1; fixed 38.6.0. Source: OSV GHSA-5j9r-fx4x-rpvg
-  / rucio (rucio): 39.0.0 (affected, PyPI); 39.0.0rc1 (affected, PyPI); 39.0.0rc2 (affected, PyPI); 39.1.0 (affected, PyPI); 39.2.0 (affected, PyPI); 39.3.0 (affected, PyPI); 39.3.1 (affected, PyPI); 39.4.0 (affected, PyPI); 39.4.1 (affected, PyPI); 39.4.2 (affected, PyPI); 40.0.0 (affected, PyPI); 40.0.0rc1 (affected, PyPI); 40.1.0 (affected, PyPI); 40.1.1 (affected, PyPI); 40.1.2 (affected, PyPI); 40.2.0 (affected, PyPI); 40.3.0 (affected, PyPI); 40.4.0 (affected, PyPI); 40.4.1 (affected, PyPI); 40.4.2 (affected, PyPI); Ecosystem version events: introduced 39.0.0rc1; fixed 41.0.0rc1. Source: OSV GHSA-5j9r-fx4x-rpvg

## Severity and prioritization

- CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-639

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/rucio/rucio/security/advisories/GHSA-5j9r-fx4x-rpvg (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/rucio/rucio/commit/64c0e6a6a93ae88427ff3b7d77532ce08c8a69ec (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/rucio/rucio/commit/8bdc38994a8766658d0314d36afc104c9242c96f (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/rucio/rucio/commit/8d9ba31514e6f5dca32b8c1db4738582cb37ec3a (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/rucio/rucio/releases/tag/35.9.0 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/rucio/rucio/releases/tag/38.6.0 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/rucio/rucio/releases/tag/41.0.0rc1 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/advisories/GHSA-5j9r-fx4x-rpvg (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-5j9r-fx4x-rpvg (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-58273; retrieved 2026-11-05; source updated 2026-11-05

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-5j9r-fx4x-rpvg; retrieved 2026-11-05; source updated 2026-10-28

Revision: 3bf1345554571f987e97beb08890b363c1182c89af43ea93ff61dd55283dd693

Canonical: https://y2.dev/cve/CVE-2026-58273

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.