CVE-2026-25136

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25136", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T14:03:42.540Z", "datePublished": "2026-02-25T18:57:28.589Z", "dateUpdated": "2026-02-26T20:44:57.174Z"}, "containers": {"cna": {"title": "Rucio WebUI has a Reflected Cross-site Scripting Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1004", "lang": "en", "description": "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q"}, {"name": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html", "tags": ["x_refsource_MISC"], "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"}, {"name": "https://github.com/rucio/rucio/releases/tag/35.8.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/rucio/rucio/releases/tag/35.8.3"}, {"name": "https://github.com/rucio/rucio/releases/tag/38.5.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/rucio/rucio/releases/tag/38.5.4"}, {"name": "https://github.com/rucio/rucio/releases/tag/39.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rucio/rucio/releases/tag/39.3.1"}], "affected": [{"vendor": "rucio", "product": "rucio", "versions": [{"version": "< 35.8.3", "status": "affected"}, {"version": ">= 36.0.0rc1, < 38.5.4", "status": "affected"}, {"version": ">= 39.0.0rc1, < 39.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T18:57:28.589Z"}, "descriptions": [{"lang": "en", "value": "Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue."}], "source": {"advisory": "GHSA-h79m-5jjm-jm4q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T20:44:39.867866Z", "id": "CVE-2026-25136", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:44:57.174Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25136", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T20:44:39.867866Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:44:49.572Z"}}], "cna": {"title": "Rucio WebUI has a Reflected Cross-site Scripting Vulnerability", "source": {"advisory": "GHSA-h79m-5jjm-jm4q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rucio", "product": "rucio", "versions": [{"status": "affected", "version": "< 35.8.3"}, {"status": "affected", "version": ">= 36.0.0rc1, < 38.5.4"}, {"status": "affected", "version": ">= 39.0.0rc1, < 39.3.1"}]}], "references": [{"url": "https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q", "name": "https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html", "name": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rucio/rucio/releases/tag/35.8.3", "name": "https://github.com/rucio/rucio/releases/tag/35.8.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rucio/rucio/releases/tag/38.5.4", "name": "https://github.com/rucio/rucio/releases/tag/38.5.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rucio/rucio/releases/tag/39.3.1", "name": "https://github.com/rucio/rucio/releases/tag/39.3.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1004", "description": "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T18:57:28.589Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25136", "state": "PUBLISHED", "dateUpdated": "2026-02-26T20:44:57.174Z", "dateReserved": "2026-01-29T14:03:42.540Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T18:57:28.589Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rucio", "vendor": "rucio", "versions": [{"status": "affected", "version": "< 35.8.3"}, {"status": "affected", "version": ">= 36.0.0rc1, < 38.5.4"}, {"status": "affected", "version": ">= 39.0.0rc1, < 39.3.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*", "matchCriteriaId": "3BCD5122-895C-41F6-8DDE-5DD999D88FDC", "versionEndExcluding": "35.8.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*", "matchCriteriaId": "364DE7B4-B341-4A96-917B-B2D37777CB7E", "versionEndExcluding": "38.5.4", "versionStartIncluding": "36.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB66BA62-B3B2-45C5-99AC-59CC9B39F350", "versionEndExcluding": "39.3.1", "versionStartIncluding": "39.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue."}, {"lang": "es", "value": "Rucio es un framework de software que proporciona funcionalidad para organizar, gestionar y acceder a grandes vol\u00famenes de datos cient\u00edficos utilizando pol\u00edticas personalizables. Una vulnerabilidad de cross-site scripting reflejado fue localizada en versiones anteriores a la 35.8.3, 38.5.4 y 39.3.1 en la renderizaci\u00f3n del ExceptionMessage del error 500 de la WebUI, lo que podr\u00eda permitir a los atacantes robar tokens de sesi\u00f3n de inicio de sesi\u00f3n de usuarios que naveguen a una URL especialmente dise\u00f1ada. Las versiones 35.8.3, 38.5.4 y 39.3.1 solucionan el problema."}], "id": "CVE-2026-25136", "lastModified": "2026-06-17T10:24:10.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25136", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T20:44:39.867866Z", "version": "2.0.3"}}]}, "published": "2026-02-25T20:23:47.273", "references": [{"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/rucio/rucio/releases/tag/35.8.3"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/rucio/rucio/releases/tag/38.5.4"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/rucio/rucio/releases/tag/39.3.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-1004"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,35.8.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[36.0.0rc1,38.5.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[39.0.0rc1,39.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rucio", "source": "cna", "vendor": "rucio"}, "product": "rucio", "vendor": "rucio"}], "analysis": {"en": {"generated_at": "2026-04-17T14:59:25.379762+00:00", "value": {"mitigation_remediation": ["Upgrade Rucio to version 35.8.3 or newer (including 38.5.4 and 39.3.1) and restart the service", "Disable detailed error messages in the WebUI so that exception content is not displayed to the user", "Apply defensive HTML escaping to all user\u2011controlled data before rendering within the UI"], "summary": {"action": "Patch Now", "impact": "Cross\u2011site scripting enabling theft of session tokens"}, "threat_synthesis": {"affected_systems": "The issue impacts the Rucio framework produced by CERN, the software that manages large scientific datasets. Versions that are older than 35.8.3, 38.5.4, and 39.3.1 contain the flaw and are therefore vulnerable. The affected releases are used in large research collaborations that rely on Rucio for data access.", "description_and_impact": "Rucio exhibits a reflected XSS flaw in the rendering of the ExceptionMessage on 500 error pages. By causing a specific exception and delivering a maliciously crafted URL, an attacker can inject script that runs in the victim\u2019s browser and reads the login session cookie. This vulnerability is a classic reflected input problem (CWE\u20111004) and a classic reflected XSS (CWE\u201179), allowing an attacker to hijack a user\u2019s authenticated session and gain unauthorized access to data.", "risk_and_exploitability": "The CVSS v3.1 base score of 8.1 indicates high severity. EPSS indicates a very low exploitation probability (<1%), and it is not listed in the CISA KEV catalog. The attack requires remote access to the WebUI via a crafted URL and depends on the victim having an authenticated session; the craft is delivered through HTTP GET or POST. With these prerequisites, an attacker could exfiltrate session tokens and impersonate the user, compromising both confidentiality and integrity of sensitive scientific data."}}}}, "created": "2026-02-26T13:14:59.660056+00:00", "updated": "2026-04-17T15:00:11.039938+00:00", "vendors": ["rucio", "rucio$PRODUCT$rucio"]}