Rucio SSH Challenge Tokens Accepted as Full Auth Credentials, Enabling Unauthenticated Admin Impersonation

What happened

A GitHub Security Advisory (GHSA-x585-4vv8-2mh2, tracked as CVE-2026-100397, CVSS 9.8) describes a critical authentication flaw in Rucio. According to the advisory, Rucio's SSH challenge tokens are short-lived nonces meant only for use in an SSH key-exchange flow. These tokens are stored in the same database table as regular authentication tokens. The validate_auth_token function in lib/rucio/core/authentication.py does not distinguish between the two token types.

A challenge token can be requested for any account name supplied via the X-Rucio-Account header without prior authentication. The advisory states that an unauthenticated attacker can request a challenge token for an account such as root and then present that token as a bearer X-Rucio-Auth-Token to other API endpoints. The token is valid for a ten-second window. A public proof-of-concept is included in the advisory.

Why it matters for defenders

This allows unauthenticated impersonation of arbitrary Rucio accounts, including administrative ones, against an exposed Rucio REST API. The exploit path requires no credentials and no user interaction. The advisory lists exploit status as PoC-public, meaning working exploit code is available. Instances reachable from untrusted networks are at risk of account takeover.

What defenders should watch for now

• Identify any Rucio deployments in your environment and check whether the /auth/ssh_challenge_token endpoint is reachable from untrusted networks.
• Hunt for use of X-Rucio-Auth-Token values that originate from a prior ssh_challenge_token request rather than a normal login flow, especially tokens used within seconds of issuance.
• Review authentication and audit logs for requests to sensitive accounts such as root that lack a corresponding normal authentication event.
• Apply the vendor's patch or guidance when available. Until then, consider restricting access to the affected authentication endpoints, rate-limiting challenge-token requests, and monitoring for impersonation attempts of privileged accounts.

Developing intel

This is a same-day advisory and details may change as the Rucio project and deployers respond. Treat the specifics above as reported by the source and verify against your own environment and the vendor's updates. Full details and the proof-of-concept: GHSA-x585-4vv8-2mh2.