Medium severity · published Feb 25, 2026
CVE-2026-25136
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
rucio · rucio
< 35.8.3; >= 36.0.0rc1, < 38.5.4; >= 39.0.0rc1, < 39.3.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25136
Not Applicable
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
Product
https://github.com/rucio/rucio/releases/tag/35.8.3
Product
https://github.com/rucio/rucio/releases/tag/38.5.4
Product
https://github.com/rucio/rucio/releases/tag/39.3.1
Exploit
https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q
More from rucio
8.8
CVE-2026-29090
Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database
8.8
CVE-2026-29080
Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API
5.4
CVE-2026-25733
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
5.3
CVE-2026-25138
Rucio WebUI has Username Enumeration via Login Error Message
4.8
CVE-2026-25736
Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute