TI-2026-20300 Aliases CVE-2026-25138 GHSA-38wq-6q2w-hcf9

Rucio WebUI has Username Enumeration via Login Error Message

MEDIUM 63CWE-204Published 2026-02-25 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-204.

Summary

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00375 31st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed rucio (rucio): 35.8.3, 38.5.4, 39.3.1rucio-webui (PyPI): 35.8.3, 38.5.4, 39.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
indico	rucio	before 35.8.3; 36.0.0rc1 to before 38.5.4; 39.0.0rc1 to before 39.3.1	35.8.3, 38.5.4, 39.3.1	Patch available	CNA
—	rucio-webui (PyPI)	before 35.8.3	35.8.3	Patch available	GHSA-38wq-6q2w-hcf9
—	rucio-webui (PyPI)	36.0.0rc1 to before 38.5.4	38.5.4	Patch available	GHSA-38wq-6q2w-hcf9
—	rucio-webui (PyPI)	39.0.0rc1 to before 39.3.1	39.3.1	Patch available	GHSA-38wq-6q2w-hcf9

rucio Vendorindico Affected before 35.8.3; 36.0.0rc1 to before 38.5.4; 39.0.0rc1 to before 39.3.1 Fixed in 35.8.3, 38.5.4, 39.3.1 Patch available CNA
rucio-webui (PyPI) Vendor— Affected before 35.8.3 Fixed in 35.8.3 Patch available GHSA-38wq-6q2w-hcf9
rucio-webui (PyPI) Vendor— Affected 36.0.0rc1 to before 38.5.4 Fixed in 38.5.4 Patch available GHSA-38wq-6q2w-hcf9
rucio-webui (PyPI) Vendor— Affected 39.0.0rc1 to before 39.3.1 Fixed in 39.3.1 Patch available GHSA-38wq-6q2w-hcf9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cern:rucio::::::::	before 35.8.3; 36.0.0 to before 38.5.4; 39.0.0 to before 39.3.1	Vulnerable	indico

cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:* Versions before 35.8.3; 36.0.0 to before 38.5.4; 39.0.0 to before 39.3.1 Vulnerable ·indico

Remediation

Fix · CNA rucio (rucio) Fixed in 35.8.3, 38.5.4, 39.3.1
Fix · GHSA-38wq-6q2w-hcf9 rucio-webui (PyPI) Fixed in 35.8.3 Advisory →
Fix · GHSA-38wq-6q2w-hcf9 rucio-webui (PyPI) Fixed in 38.5.4 Advisory →
Fix · GHSA-38wq-6q2w-hcf9 rucio-webui (PyPI) Fixed in 39.3.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-25138
2026-10-03 Alias added: GHSA-38wq-6q2w-hcf9

References

Exploit 1

https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-25138

Other 5

TI-2026-20298 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability CVSS 3.1HIGH 8.1
TI-2026-20801 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function CVSS 3.1HIGH 7.3
TI-2026-20804 Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute CVSS 3.1MEDIUM 6.1
TI-2026-20803 Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name CVSS 3.1MEDIUM 6.1
TI-2026-20802 Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata CVSS 3.1MEDIUM 6.1
TI-2026-23225 Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API CVSS 4.0CRITICAL 9.4

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences