Read the docs
TI-2026-20298 Aliases CVE-2026-25136GHSA-h79m-5jjm-jm4q

Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

Priority HIGH 68CWE-1004Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0031 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed rucio (rucio): 35.8.3, 38.5.4, 39.3.1rucio-webui (PyPI): 35.8.3, 38.5.4, 39.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
indicoruciobefore 35.8.3; 36.0.0rc1 to before 38.5.4; 39.0.0rc1 to before 39.3.135.8.3, 38.5.4, 39.3.1Patch availableCNA
—rucio-webui (PyPI)before 35.8.335.8.3Patch availableGHSA-h79m-5jjm-jm4q
—rucio-webui (PyPI)36.0.0rc1 to before 38.5.438.5.4Patch availableGHSA-h79m-5jjm-jm4q
—rucio-webui (PyPI)39.0.0rc1 to before 39.3.139.3.1Patch availableGHSA-h79m-5jjm-jm4q
  • rucio Vendorindico Affected before 35.8.3; 36.0.0rc1 to before 38.5.4; 39.0.0rc1 to before 39.3.1 Fixed in 35.8.3, 38.5.4, 39.3.1 Patch available CNA
  • rucio-webui (PyPI) Vendor— Affected before 35.8.3 Fixed in 35.8.3 Patch available GHSA-h79m-5jjm-jm4q
  • rucio-webui (PyPI) Vendor— Affected 36.0.0rc1 to before 38.5.4 Fixed in 38.5.4 Patch available GHSA-h79m-5jjm-jm4q
  • rucio-webui (PyPI) Vendor— Affected 39.0.0rc1 to before 39.3.1 Fixed in 39.3.1 Patch available GHSA-h79m-5jjm-jm4q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*before 35.8.3; 36.0.0 to before 38.5.4; 39.0.0 to before 39.3.1Vulnerableindico
  • cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:* Versions before 35.8.3; 36.0.0 to before 38.5.4; 39.0.0 to before 39.3.1 Vulnerable ·indico

Remediation

  • Fix · CNA rucio (rucio) Fixed in 35.8.3, 38.5.4, 39.3.1
  • Fix · GHSA-h79m-5jjm-jm4q rucio-webui (PyPI) Fixed in 35.8.3 Advisory →
  • Fix · GHSA-h79m-5jjm-jm4q rucio-webui (PyPI) Fixed in 38.5.4 Advisory →
  • Fix · GHSA-h79m-5jjm-jm4q rucio-webui (PyPI) Fixed in 39.3.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25136
  2. 2026-10-03 Alias added: GHSA-h79m-5jjm-jm4q

References

Exploit 1

Advisory 1

Other 5

  • TI-2026-20801 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function CVSS 3.1HIGH 7.3
  • TI-2026-20300 Rucio WebUI has Username Enumeration via Login Error Message CVSS 3.1MEDIUM 5.3
  • TI-2026-20804 Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute CVSS 3.1MEDIUM 6.1
  • TI-2026-20803 Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name CVSS 3.1MEDIUM 6.1
  • TI-2026-20802 Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata CVSS 3.1MEDIUM 6.1
  • TI-2026-23225 Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API CVSS 4.0CRITICAL 9.4
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences