Skip to content
Fencer Intel
critical 9.8

CVE-2026-100397 json

Rucio: Unauthenticated administrator impersonation through SSH challenge tokens

published 2d ago modified 2d ago also GHSA-x585-4vv8-2mh2

cvss
9.8
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

## Summary

SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process.

While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate between these and actual authentication tokens. Because challenge tokens are generated based on an account name provided via headers without requiring prior authentication, an unauthenticated attacker can request a valid "challenge" token for any account (including administrative ones) and use it to authenticate against other API endpoints.

## Proof of Concept

The vulnerability exists because SSH challenge tokens are stored in the same database table as regular authentication tokens and `validate_auth_token` in `lib/rucio/core/authentication.py` accepts these "challenge" tokens. An attacker can obtain a challenge token for an account such as “root” via the REST API and then present it as a valid authentication bearer token:

1. Request a challenge token for an arbitrary account (e.g., "root"): `curl -i -H "X-Rucio-Account: root" https://rucio/auth/ssh_challenge_token` 2. The server returns a `200 OK` with the header `X-Rucio-SSH-Challenge-Token`. 3. The attacker can then use this specific token within the ten-second challenge lifetime as an authentication credential in subsequent requests to the Rucio API: `curl -H "X-Rucio-Auth-Token: $CHALLENGE_TOKEN" https://rucio/accounts/whoami`

Patch / fix

  • pypi rucio 35.9.1, 38.6.1, 40.4.2, 41.1.1

Is CVE-2026-100397 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi rucio
>=1.14.0.post1, <35.9.1
>=36.0.0rc1, <38.6.1
>=39.0.0rc1, <40.4.2
>=41.0.0rc1, <41.1.1
35.9.1
38.6.1
40.4.2
41.1.1

Classification

Weakness
  • CWE-287 Improper Authentication
  • CWE-305 Authentication Bypass by Primary Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.