CVE-2026-29090 is a critical SQL injection vulnerability in Rucio's FilterEngine component, specifically in the create_postgres_query() method used by the postgres_meta metadata plugin. The vulnerability occurs because filter keys and values derived from HTTP query parameters are directly interpolated into raw SQL strings via Python's str.format() without sanitization. The resulting SQL string is then wrapped as trusted SQL syntax and executed, enabling attackers with valid authentication to execute arbitrary SQL commands against the PostgreSQL metadata database. This can lead to full database compromise, including data exfiltration, modification, and possible remote code execution via PostgreSQL's COPY ... FROM PROGRAM feature. The vulnerability affects Rucio versions >=1.30.0 <35.8.5, >=36.0.0 <38.5.5, >=39.0.0 <39.4.2, and >=40.0.0 <40.1.1 when the postgres_meta plugin is configured. The default metadata plugin (json_meta) is not vulnerable. No effective input validation or sanitization is performed on filter keys or values, and the postgres_meta plugin accepts any filter key unconditionally.

An authenticated Rucio user can exploit this vulnerability to execute arbitrary SQL commands on the PostgreSQL metadata database. This can result in complete database compromise including unauthorized data access, data modification, and deletion. Additionally, the attacker may achieve remote code execution on the database server via PostgreSQL features like COPY ... FROM PROGRAM. The impact is critical due to the potential for full system compromise and data breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling or disable the postgres_meta metadata plugin if possible. Restrict access to the DID search API to trusted users only. Monitor vendor communications for updates and apply official patches promptly once released.