Security · High impactFan score 44 · Tier B
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens (CVE-2026-100397)
The Brief
- Rucio accepts SSH challenge tokens as valid credentials during authentication token validation.
- The flaw allows unauthenticated administrator impersonation and is tracked as CVE-2026-100397.
- The GitHub Advisory Database published the advisory on 2026-11-13.
Why it matters
Rucio deployments can be accessed by unauthenticated attackers who impersonate administrators, so operators should treat affected instances as at risk until they confirm a fix.
Who’s affected
- Rucio operators
- CVE-2026-100397
- #security
- #rucio
- #authentication
- #vulnerability
- #ssh
Affects rucio. Summary SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process. While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate…
Timeline
Vulnerability disclosed in GitHub Advisory Database
GitHub Advisory Database
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens (CVE-2026-100397)