Reflected Cross-Site Scripting Vulnerability in Rucio Software by Rucio
CVE-2026-25136

8.1HIGH

Key Information:

Vendor

Rucio

Status
Rucio
Vendor
CVE Published:
25 February 2026

What is CVE-2026-25136?

A reflected Cross-Site Scripting vulnerability exists in the Rucio software's WebUI exception handling. Specifically, it affects versions prior to 35.8.3, 38.5.4, and 39.3.1. Attackers can exploit this vulnerability by crafting a malicious URL that, when accessed, can lead to the theft of user session tokens. This happens during the rendering of the ExceptionMessage for a WebUI 500 error, presenting significant security risks for users handling sensitive scientific data.

Affected Version(s)

rucio < 35.8.3 < 35.8.3

rucio >= 36.0.0rc1, < 38.5.4 < 36.0.0rc1, 38.5.4

rucio >= 39.0.0rc1, < 39.3.1 < 39.0.0rc1, 39.3.1

References

https://github.com/rucio/rucio/security/advisories/GHSA-h...
x_refsource_CONFIRM
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site...
x_refsource_MISC
https://github.com/rucio/rucio/releases/tag/35.8.3
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.