User Enumeration Vulnerability in Rucio WebUI Providing Scientific Data Management
CVE-2026-25138
What is CVE-2026-25138?
The Rucio software framework, utilized for organizing and managing large datasets in scientific environments, previously exhibited a security flaw in its WebUI login endpoint. This vulnerability allowed unauthorized users to ascertain valid usernames by delivering different error messages based on the existence of a username. By exploiting this weakness, an attacker could refine their attack strategy, posing significant risks to the security and integrity of user accounts. This issue has been addressed in subsequent versions 35.8.3, 38.5.4, and 39.3.1. For further details and patches, please refer to the official Rucio releases.
Affected Version(s)
rucio < 35.8.3 < 35.8.3
rucio >= 36.0.0rc1, < 38.5.4 < 36.0.0rc1, 38.5.4
rucio >= 39.0.0rc1, < 39.3.1 < 39.0.0rc1, 39.3.1