Medium severity · published Feb 25, 2026
CVE-2026-25138
Rucio WebUI has Username Enumeration via Login Error Message
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
rucio · rucio
< 35.8.3; >= 36.0.0rc1, < 38.5.4; >= 39.0.0rc1, < 39.3.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25138
Not Applicable
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages
Product
https://github.com/rucio/rucio/releases/tag/35.8.3
Product
https://github.com/rucio/rucio/releases/tag/38.5.4
Product
https://github.com/rucio/rucio/releases/tag/39.3.1
Exploit
https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9
More from rucio
8.8
CVE-2026-29090
Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database
8.8
CVE-2026-29080
Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API
6.1
CVE-2026-25136
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
5.4
CVE-2026-25733
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
4.8
CVE-2026-25736
Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute