Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name

Vulnerability

Overview

CVE-2026-25735 is a stored Cross-Site Scripting (XSS) vulnerability in the Rucio WebUI of Rucio, a scientific data management framework. The vulnerability exists in the Identity Name field, where attacker-controlled input is persisted by the backend and later rendered in the account identity name and later rendered in the WebUI without proper output encoding [2]. Consequently, arbitrary JavaScript can execute in the context of the WebUI for any user who views the affected page [3].

Exploitation

An authenticated user can inject a malicious payload into the Identity Name through the account management interface (Admin > Account Management > ACCOUNT NAME > Add Account Identity). The payload is stored and triggered when another user visits the account view page (e.g., /ui/account?account=pentest) [3]. No special network position is required beyond standard WebUI access.

Impact

Successful exploitation enables arbitrary JavaScript execution in the WebUI origin for users viewing the affected viewers. This can lead to session cookie theft (if cookies lack HttpOnly flag), API token exfiltration, and unauthorized actions such as creating new identities with attacker-known passwords, modifying Rucio Storage Elements (RSEs), or exfiltrating scientific data [3]. The attack may affect all users or only administrative users depending on the feature viewed.

Mitigation

The vulnerability is fixed in Rucio versions 35.8.3, 38.5.4, and 39.3.1 [2]. The fix applies proper output encoding to the Identity Name field, preventing stored XSS. Users should upgrade to a patched version. No workaround is listed in CISA KEV or similar databases