CVE-2026-25136

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

• CWE-79
• CWE-1004
• CWE-79

• https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.htmlNot Applicable
• https://github.com/rucio/rucio/releases/tag/35.8.3Product, Release Notes
• https://github.com/rucio/rucio/releases/tag/38.5.4Product, Release Notes
• https://github.com/rucio/rucio/releases/tag/39.3.1Product, Release Notes
• https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4qExploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2513A vulnerability exists in Progress Flowmon ADS versions prio…8.6
• CVE-2026-25130Cybersecurity AI (CAI) is a framework for AI Security. In ve…9.6
• CVE-2026-25131OpenEMR is a free and open source electronic health records …8.8
• CVE-2026-25133October is a Content Management System (CMS) and web platfor…4.8
• CVE-2026-25134Group-Office is an enterprise customer relationship manageme…8.8
• CVE-2026-25135OpenEMR is a free and open source electronic health records …4.5
• CVE-2026-25137The NixOs Odoo package is an open source ERP and CRM system.…9.1
• CVE-2026-25138Rucio is a software framework that provides functionality to…5.3
• CVE-2026-25139RIOT is an open-source microcontroller operating system, des…9.1
• CVE-2026-2514In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3,…8.6
• CVE-2026-25140apko allows users to build and publish OCI container images …7.5
• CVE-2026-25141Orval generates type-safe JS clients (TypeScript) from any v…9.8