Read the docs
TI-2026-20802 Aliases CVE-2026-25734GHSA-h9fp-p2p9-873q

Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Priority MEDIUM 62CWE-1004Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the RSE metadata of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed rucio (rucio): 35.8.3, 38.5.4, 39.3.1rucio-webui (PyPI): 35.8.3, 38.5.4, 39.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
indicoruciobefore 35.8.3; 36.0.0rc1 to before 38.5.4; 39.0.0rc1 to before 39.3.135.8.3, 38.5.4, 39.3.1Patch availableCNA
—rucio-webui (PyPI)before 35.8.335.8.3Patch availableGHSA-h9fp-p2p9-873q
—rucio-webui (PyPI)36.0.0rc1 to before 38.5.438.5.4Patch availableGHSA-h9fp-p2p9-873q
—rucio-webui (PyPI)39.0.0rc1 to before 39.3.139.3.1Patch availableGHSA-h9fp-p2p9-873q
  • rucio Vendorindico Affected before 35.8.3; 36.0.0rc1 to before 38.5.4; 39.0.0rc1 to before 39.3.1 Fixed in 35.8.3, 38.5.4, 39.3.1 Patch available CNA
  • rucio-webui (PyPI) Vendor— Affected before 35.8.3 Fixed in 35.8.3 Patch available GHSA-h9fp-p2p9-873q
  • rucio-webui (PyPI) Vendor— Affected 36.0.0rc1 to before 38.5.4 Fixed in 38.5.4 Patch available GHSA-h9fp-p2p9-873q
  • rucio-webui (PyPI) Vendor— Affected 39.0.0rc1 to before 39.3.1 Fixed in 39.3.1 Patch available GHSA-h9fp-p2p9-873q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*before 35.8.3; 36.0.0 to before 38.5.4; 39.0.0 to before 39.3.1Vulnerableindico
  • cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:* Versions before 35.8.3; 36.0.0 to before 38.5.4; 39.0.0 to before 39.3.1 Vulnerable ·indico

Remediation

  • Fix · CNA rucio (rucio) Fixed in 35.8.3, 38.5.4, 39.3.1
  • Fix · GHSA-h9fp-p2p9-873q rucio-webui (PyPI) Fixed in 35.8.3 Advisory →
  • Fix · GHSA-h9fp-p2p9-873q rucio-webui (PyPI) Fixed in 38.5.4 Advisory →
  • Fix · GHSA-h9fp-p2p9-873q rucio-webui (PyPI) Fixed in 39.3.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25734
  2. 2026-10-03 Alias added: GHSA-h9fp-p2p9-873q

References

Exploit 1

Advisory 1

Other 5

  • TI-2026-20298 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability CVSS 3.1HIGH 8.1
  • TI-2026-20801 Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function CVSS 3.1HIGH 7.3
  • TI-2026-20300 Rucio WebUI has Username Enumeration via Login Error Message CVSS 3.1MEDIUM 5.3
  • TI-2026-20804 Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute CVSS 3.1MEDIUM 6.1
  • TI-2026-20803 Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name CVSS 3.1MEDIUM 6.1
  • TI-2026-23225 Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API CVSS 4.0CRITICAL 9.4
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences