Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-288.
Summary
### Impact `rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated. Rucio server / daemons are not affected by this issue, it is isolated to the webui. ### Patches This issue is fixed in the `1.26.7` release of the `rucio-webui`. ### Workarounds Installation of the `1.25.7` `webui` release. The `1.25` and previous webui release lines are not affected by this issue. ### References https://github.com/rucio/rucio/issues/4928
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | rucio-webui (PyPI) | 1.26.0 to before 1.26.7 | 1.26.7 | Patch available | GHSA-v988-828w-xvf2 |
- rucio-webui (PyPI) Vendor— Affected 1.26.0 to before 1.26.7 Fixed in 1.26.7 Patch available GHSA-v988-828w-xvf2
Remediation
- Fix · GHSA-v988-828w-xvf2 rucio-webui (PyPI) Fixed in 1.26.7 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-v988-828w-xvf2
References
Other 6
- https://github.com/rucio/rucio/security/advisories/GHSA-v988-828w-xvf2
- https://github.com/rucio/rucio/issues/4810
- https://github.com/rucio/rucio/issues/4928
- https://github.com/rucio/rucio/commit/8f832404ae88d6300e17d7e706b40fe58e0df90c
- https://github.com/rucio/rucio
- https://github.com/rucio/rucio/releases/tag/1.26.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences