CVE-2026-25138 json
Rucio WebUI has Username Enumeration via Login Error Message
published 2026-02-25 8 mo ago modified 2026-07-13 3 mo ago also GHSA-38wq-6q2w-hcf9 , PYSEC-2026-3053 , EUVD-2026-8712
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Patch / fix
- pypi rucio-webui 35.8.3, 38.5.4, 39.3.1
- cern rucio 35.8.3, 38.5.4, 39.3.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | rucio-webui | <35.8.3 >=36.0.0rc1, <38.5.4 >=39.0.0rc1, <39.3.1 |
35.8.3 38.5.4 39.3.1 |
Affected products
- rucio rucio
Classification
- Weakness
-
- CWE-204 Observable Response Discrepancy
References
-
github.com
/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9
exploit, web, vendor-advisory
-
cheatsheetseries.owasp.org
/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages
web, not-applicable
-
github.com
/rucio/rucio/releases/tag/35.8.3
web, product, release-notes
-
github.com
/rucio/rucio/releases/tag/38.5.4
web, product, release-notes
-
github.com
/rucio/rucio/releases/tag/39.3.1
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-25138
advisory
-
github.com
/rucio/rucio
package
-
pypi.org
/project/rucio-webui
package
-
github.com
/advisories/GHSA-38wq-6q2w-hcf9
advisory
Sources
- CVE List CVE-2026-25138
- GitHub Advisory GHSA-38wq-6q2w-hcf9
- NVD CVE-2026-25138
- OSV PYSEC-2026-3053
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.