CVE-2026-25138 Details
Description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9 | CISA-ADP | ExploitVendor Advisory |
| https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages | [email protected] | Not Applicable |
| https://github.com/rucio/rucio/releases/tag/35.8.3 | [email protected] | ProductRelease Notes |
| https://github.com/rucio/rucio/releases/tag/38.5.4 | [email protected] | ProductRelease Notes |
| https://github.com/rucio/rucio/releases/tag/39.3.1 | [email protected] | ProductRelease Notes |
| https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cern rucio | < 35.8.3 >= 36.0.0, < 38.5.4 >= 39.0.0, < 39.3.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 27, 2026 | Initial Analysis | [email protected] |
| Feb 26, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | New CVE Received | [email protected] |