CVE-2026-25138
Last modified
CVE-2026-25138 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cern | Rucio | < 35.8.3 |
| Cern | Rucio | >= 36.0.0, < 38.5.4 |
| Cern | Rucio | >= 39.0.0, < 39.3.1 |
References
- https://github.com/rucio/rucio/releases/tag/35.8.3Product, Release Notes
- https://github.com/rucio/rucio/releases/tag/38.5.4Product, Release Notes
- https://github.com/rucio/rucio/releases/tag/39.3.1Product, Release Notes
- https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9Exploit, Vendor Advisory
- https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-25138?
How severe is CVE-2026-25138?
How do I fix CVE-2026-25138?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-25131OpenEMR is a free and open source electronic health records …8.8
- CVE-2026-25133October is a Content Management System (CMS) and web platfor…4.8
- CVE-2026-25134Group-Office is an enterprise customer relationship manageme…8.8
- CVE-2026-25135OpenEMR is a free and open source electronic health records …4.5
- CVE-2026-25136Rucio is a software framework that provides functionality to…6.1
- CVE-2026-25137The NixOs Odoo package is an open source ERP and CRM system.…9.1
- CVE-2026-25139RIOT is an open-source microcontroller operating system, des…9.1
- CVE-2026-2514In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3,…8.6
- CVE-2026-25140apko allows users to build and publish OCI container images …7.5
- CVE-2026-25141Orval generates type-safe JS clients (TypeScript) from any v…9.8
- CVE-2026-25142SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10
- CVE-2026-25143melange allows users to build apk packages using declarative…7.8
Are you affected by CVE-2026-25138?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST