# CVE-2026-58273 - Rucio: Authorisation Bypass on REST API endpoint for signing URLs

DevFeed: [CVE-2026-58273 - Rucio: Authorisation Bypass on REST API endpoint for signing URLs](<https://devfeed.tech/articles/cve-2026-58273-rucio-authorisation-bypass-on-rest-api-endpoint-for-signing-urls-119651.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-58273>)

Author: CVEFEED.io; github.com

Published: 2026-11-05T22:18:49Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [REST API](<https://devfeed.tech/topics/rest-api.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [account](<https://devfeed.tech/tags/account.md>), [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cross](<https://devfeed.tech/tags/cross.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-58273](<https://devfeed.tech/tags/cve-2026-58273.md>), [data](<https://devfeed.tech/tags/data.md>), [delete](<https://devfeed.tech/tags/delete.md>), [disclosure](<https://devfeed.tech/tags/disclosure.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [framework](<https://devfeed.tech/tags/framework.md>), [gcs](<https://devfeed.tech/tags/gcs.md>), [rest](<https://devfeed.tech/tags/rest.md>), [rest-api](<https://devfeed.tech/tags/rest-api.md>), [signing](<https://devfeed.tech/tags/signing.md>), [urls](<https://devfeed.tech/tags/urls.md>)

## AI overview

Rucio's `/credentials/signurl` endpoint checks the account supplied in `X-Rucio-Account` instead of the authenticated issuer, allowing any authenticated low-privilege user to claim `root` and pass the root-only permission check. The endpoint can then issue presigned read, write, or delete URLs for attacker-selected objects using stored S3, GCS, or Swift credentials; in multi-VO deployments, `X-Rucio-VO` can select another tenant. The described impact includes data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. The issue is listed as fixed in 35.9.0, 38.6.0, and 41.0.0rc1.

## Source excerpt

CVE ID :CVE-2026-58273 Published : Nov. 5, 2026, 10:18 p.m. | 1 hour, 4 minutes ago Description :Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...