CVE-2026-25136: Rucio WebUI Reflected Cross-site Scripting Vulnerability
Summary
CVE-2026-25136: Rucio WebUI has a Reflected Cross-site Scripting Vulnerability. Affects rucio-webui across 3 version ranges.
< 35.8.3
>= 36.0.0rc1, < 38.5.4
>= 39.0.0rc1, < 39.3.1
Fixed in 35.8.3, 38.5.4 or 39.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rucio is an open-source software framework designed for data management in scientific computing. It provides a WebUI for users to interact with the system, allowing them to manage accounts, data transfers, and storage resources. The WebUI is crucial for user engagement, but it has been found to be vulnerable to reflected cross-site scripting (XSS) attacks, which can compromise user sessions and sensitive data.
Vulnerability Detail
The vulnerability arises from the rendering of the ExceptionMessage in the WebUI 500 error responses, which allows user-controlled input to be displayed as unencoded HTML. This flaw enables attackers to craft malicious URLs that, when accessed by users, can execute arbitrary JavaScript in the context of the WebUI. The lack of proper encoding and the use of unsafe methods to insert content into the DOM make this vulnerability particularly dangerous, as it can lead to session hijacking and unauthorized actions on behalf of the victim.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 35.8.335.8.3pip install --upgrade "rucio-webui==35.8.3" -
>= 36.0.0rc1, < 38.5.438.5.4pip install --upgrade "rucio-webui==38.5.4" -
>= 39.0.0rc1, < 39.3.139.3.1pip install --upgrade "rucio-webui==39.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid clicking on untrusted links that may exploit this vulnerability. If you must use the WebUI, ensure that you are not providing any input that could be controlled by an attacker.
Conclusion
The Rucio WebUI is vulnerable to a reflected cross-site scripting attack due to improper handling of user input in error messages. This vulnerability can lead to serious security risks, including session hijacking. It is crucial to update to the latest patched versions and implement safe coding practices to mitigate this risk.
See every vulnerability recorded for rucio-webui →
FAQ
Reflected XSS is a type of cross-site scripting attack where malicious scripts are reflected off a web server, typically via a URL, and executed in the user's browser.
An attacker can steal your session cookies or tokens, allowing them to impersonate you and perform actions on your behalf.
If you suspect that your session has been compromised, log out immediately and change your password. Monitor your account for any unauthorized activity.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for rucio-webui.
