# Rucio: Unauthenticated administrator impersonation through SSH challenge tokens (CVE-2026-100397)

Source: [GitHub Advisory Database](https://github.com/advisories/GHSA-x585-4vv8-2mh2) · 2026-11-13 · Security
Page: https://themorning.dev/story/rucio-unauthenticated-administrator-impersonation-through-ssh-challenge-tokens-c-07da002b7897c2e7
Kind: security · Impact: high

## In brief

- Rucio accepts SSH challenge tokens as valid credentials during authentication token validation.
- The flaw allows unauthenticated administrator impersonation and is tracked as CVE-2026-100397.
- The GitHub Advisory Database published the advisory on 2026-11-13.

## Why it matters

Rucio deployments can be accessed by unauthenticated attackers who impersonate administrators, so operators should treat affected instances as at risk until they confirm a fix.

## CVEs

- CVE-2026-100397

## Timeline

- 2026-11-13: Vulnerability disclosed in GitHub Advisory Database

## Coverage

- [Rucio: Unauthenticated administrator impersonation through SSH challenge tokens (CVE-2026-100397)](https://github.com/advisories/GHSA-x585-4vv8-2mh2) — GitHub Advisory Database, 2026-11-13

Tags: security, rucio, authentication, vulnerability, ssh

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev