CVE-2026-25736: Rucio WebUI Stored XSS Vulnerability in Custom RSE Attribute
Summary
CVE-2026-25736: Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute. Affects rucio-webui across 3 version ranges.
< 35.8.3
>= 36.0.0rc1, < 38.5.4
>= 39.0.0rc1, < 39.3.1
Fixed in 35.8.3, 38.5.4 or 39.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rucio is an open-source software framework designed for managing and transferring large amounts of data across various storage systems. The Rucio WebUI provides a user-friendly interface for administrators to manage RSEs (Rucio Storage Elements) and their attributes. However, a vulnerability has been identified in the WebUI that allows for the injection of malicious scripts via custom RSE attributes, posing a significant security risk.
Vulnerability Detail
A stored Cross-site Scripting (XSS) vulnerability exists in the Rucio WebUI's Custom RSE Attribute feature. This vulnerability arises when attacker-controlled input is stored by the backend and later rendered in the WebUI without proper output encoding. As a result, any authenticated user who views the affected pages may execute arbitrary JavaScript, potentially leading to session token theft or unauthorized actions. The vulnerability can be exploited by submitting a crafted payload through the RSE Management interface, which is then executed when the RSE is viewed.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 35.8.335.8.3pip install --upgrade "rucio-webui==35.8.3" -
>= 36.0.0rc1, < 38.5.438.5.4pip install --upgrade "rucio-webui==38.5.4" -
>= 39.0.0rc1, < 39.3.139.3.1pip install --upgrade "rucio-webui==39.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, avoid using custom RSE attributes that may contain untrusted input until the package is updated. Additionally, implement a strict Content Security Policy (CSP) and set the HttpOnly flag on session cookies to reduce the risk of session hijacking.
Conclusion
The Rucio WebUI has a critical stored XSS vulnerability that can be exploited by attackers to execute arbitrary JavaScript in the context of the WebUI. It is essential to update to the patched versions of the Rucio WebUI package to mitigate this risk. Additionally, implementing security best practices such as CSP and HttpOnly flags can further protect against potential exploits.
See every vulnerability recorded for rucio-webui →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored on the server and executed in the browser of any user who accesses the affected page.
If exploited, this vulnerability can lead to session hijacking, unauthorized actions on behalf of users, and exposure of sensitive information such as session tokens and API keys.
Update the Rucio WebUI package to a patched version immediately. Review your application for any instances of custom RSE attributes that may contain untrusted input.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. It utilizes the Pipfile.lock to check for vulnerabilities without requiring access to the code.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for rucio-webui.
