Rucio: Unauthenticated administrator impersonation through SSH challenge tokens
CVE-2026-100397
Summary SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process. While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate between these and actual authentication tokens. Because challenge tokens are generated based on an account name provided via headers without requiring prior authentication, an unauthenticated attacker can request a valid "challenge" token for any account (including administrative ones) and use it to authenticate against other API endpoints. Proof of Concept The vulnerability exists because SSH challenge tokens are stored in the same database table as regular authentication tokens and validateauthtoken in lib/rucio/core/authentication.py accepts these "challenge" tokens. An attacker can obtain a challenge token for an account such as “root” via the REST API and then present it as a valid authentication bearer token: 1. Request a challenge token for an arbitrary account (e.g., "root"): curl -i -H "X-Rucio-Account: root" https://rucio/auth/sshchallengetoken 2. The server returns a 200 OK…
Assessment
- CVSS
- 9.8 (v3.1)
- Severity
- Critical
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 13 November 2026
- Last updated
- 13 November 2026
- Affected
- rucio
- Weakness
- CWE-287, CWE-305
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
At the source
References
- https://github.com/rucio/rucio/security/advisories/GHSA-x585-4vv8-2mh2
- https://github.com/rucio/rucio/commit/4d4a58571ba853f3a55aef16ad9eb0944fce7483
- https://github.com/rucio/rucio/commit/4df924feb539ef789b3e78cbc00712ef8cdf606e
- https://github.com/rucio/rucio/commit/8295d72a9e2d76abf9e98eb6f9a4ed5cb3bb1869
- https://github.com/rucio/rucio/commit/883d526c2f3c315cd775fb142038007053e3882b
- https://github.com/rucio/rucio/commit/b1725ee5477b683202174f0ec77ae00921bc3bd0
- https://github.com/rucio/rucio/commit/d7a3c2c2f933dce8edbcad07d8d076b9b782da35
- https://github.com/rucio/rucio/commit/e6525523e3bbe8ae34cbfc9b043ae52bda209b87
- https://github.com/rucio/rucio/commit/f5db3546d9c0de4642dc9aa52e6a6e447911d680
- https://github.com/rucio/rucio/releases/tag/35.9.1
- https://github.com/rucio/rucio/releases/tag/35.9.1.post1
- https://github.com/rucio/rucio/releases/tag/38.6.1
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-100397