Vulnerability · high
Rucio SSH challenge tokens allow administrator impersonation (CVE-2026-100397)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Rucio deployments accepting SSH challenge token authentication
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Remote, no login · Full takeover
The Brief
- Rucio accepts SSH challenge tokens as valid credentials during authentication token validation.
- The flaw allows unauthenticated administrator impersonation and is tracked as CVE-2026-100397.
- The GitHub Advisory Database published the advisory on 2026-11-13.
Why it matters
Rucio deployments can be accessed by unauthenticated attackers who impersonate administrators, so operators should treat affected instances as at risk until they confirm a fix.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Rucio is server software for data management that research and ops teams run. |
| No | Core infrastructure | Judgment: Rucio is a niche scientific data platform, not core infrastructure like OpenSSH or glibc. |
| No | Popular tool | Judgment: Rucio is a specialized research tool, not a widely used mainstream framework. |
| No | Exploited in the wild | GitHub Advisory Database: describes the flaw only; no report of observed attacks. |
| No | Public exploit | GitHub Advisory Database: advisory only; no source says exploit code or PoC is published. |
| Yes | Remote, no login | GitHub Advisory Database: titled 'Unauthenticated administrator impersonation' via SSH challenge tokens. |
| Yes | Full takeover | GitHub Advisory Database: unauthenticated administrator impersonation allows admin-level access. |
| No | Secrets exposed | GitHub Advisory Database: no mention of stolen credentials, tokens, keys or data. |
| No | Supply chain | GitHub Advisory Database: a validation flaw in authentication; no malicious code shipped. |
| No | No fix yet | GitHub AdvisoryGitHub Advisory: rucio fixed in 35.9.1 |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
- Fix
- rucio (pip) fixed in 35.9.1
- rucio (pip) fixed in 38.6.1
- rucio (pip) fixed in 40.4.2
- rucio (pip) fixed in 41.1.1
Timeline
Vulnerability disclosed in GitHub Advisory Database
GitHub Advisory Database
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens (CVE-2026-100397)
Source
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens (CVE-2026-100397) ↗ GitHub Advisory Database · 3h ago
First seen · 1 source · Full story page · How tiers are decided