6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25734

CVE-2026-25734: Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Summary

A stored Cross-site Scripting (XSS) vulnerability was identified in the RSE metadata of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions.

Details

Several metadata fields accept arbitrary input which is stored and later rendered unsafely in the WebUI when the RSEs are listed in the RSE Management dashboard.

Create Path:
Admin > RSE Management

Trigger Paths:
Admin > RSE Management
Admin > RSE Management > RSE NAME

Vulnerable Attributes:
City, Country_Name, ISP

Request

POST /proxy/rses/XSSTEST HTTP/1.1
...
{"city":"<script>alert('CITY XSS')</script>","country_name":"<script>alert('COUNTRY XSS')</script>","ISP":"<script>alert('ISP XSS')</script>","deterministic":false,"volatile":false,"staging_area":false}

Response

HTTP/1.1 201 CREATED
...
Created

Stored XSS payload triggering in RSE listing after adding XSS payload in metadata <img width="1252" height="624" alt="Stored XSS payload triggering in RSE listing after adding XSS payload in metadata" src="https://github.com/user-attachments/assets/6546fc95-0c81-4db7-9271-37b5d4bc8f47" />

Impact

Any authenticated user who views affected resources may execute attacker-controlled JavaScript in the WebUI origin. Depending on the affected feature, this may impact all users or administrative users only.

The impact is amplified by:

Session cookies that are accessible to JavaScript (missing HttpOnly flag).
API tokens exposed to the WebUI via JavaScript variables.

An attacker would likely attempt to exfiltrate the session token to an external site by setting an encoded version of the cookie as the path of a GET request to an attacker controlled site (i.e ).

Miggo Vulnerability Database

→

CVE-2026-25734

CVE-2026-25734:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rucio-webui	pip	< 35.8.3	35.8.3
rucio-webui	pip	>= 36.0.0rc1, < 38.5.4	38.5.4
rucio-webui

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a stored Cross-site Scripting (XSS) issue within the Rucio WebUI, specifically affecting the display of RSE (Rucio Storage Element) metadata. The vulnerable attributes are identified as 'City', 'Country_Name', and 'ISP'. The vulnerability is triggered when a user views the RSE Management dashboard or the details page for a specific RSE.

My analysis of the provided patches confirms this. The commits explicitly reference the GHSA ID for this vulnerability (GHSA-h9fp-p2p9-873q) and show changes that directly address the XSS risk.

list_rses in lib/rucio/web/ui/static/rses.js: This function is responsible for rendering the main RSE listing page. The patch (commit 80b91dd0c6737b2ab9aed039470e8e81028def41) shows that the data for the RSEs, including the vulnerable fields, was being passed directly to the DataTable library. The fix involves pre-sanitizing the data by using jQuery's .text() method to escape any HTML content before it's rendered by the table, thus preventing the XSS.
create_info_table in lib/rucio/web/ui/static/rse.js: This function is used to display the detailed attributes of a single RSE. The patch (commit 1559c59e1fc571f75775fb4f656d752b32309e24) reveals that the function was previously constructing HTML via unsafe string concatenation. This would cause any malicious script stored in an RSE attribute to be inserted directly into the DOM and executed. The fix replaces this insecure method with the safe .text() method, which properly escapes the content.

Both of these functions are client-side JavaScript and would appear in a runtime profile during the exploitation of this vulnerability. The root cause is the failure to properly sanitize server-provided data on the client-side before rendering it in the DOM.

Vulnerable functions

list_rses

lib/rucio/web/ui/static/rses.js

This function fetches and displays a list of RSEs in a DataTable. The vulnerability lies in the fact that metadata attributes like 'city', 'country_name', and 'ISP' were rendered without proper sanitization, leading to a stored XSS. An attacker could inject malicious scripts into these RSE metadata fields, which would then be executed in the browser of any user viewing the RSE management page.

create_info_table

lib/rucio/web/ui/static/rse.js

This function is responsible for creating the information table on an individual RSE's page. It iterates through the RSE's attributes and displays them. Before the patch, it used insecure string concatenation to build the table rows, allowing for the execution of injected scripts stored in the RSE metadata attributes like 'city', 'country_name', and 'ISP'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-25734: Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Summary

Details

Impact

CVE-2026-25734:

6.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

6.1

6.1

CVE-2026-25734: Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Summary

Details

Impact

Technical Details

Remediation / Mitigation

Resources

6.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-25734: Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Summary

Details

Impact

CVE-2026-25734:

6.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

6.1

6.1

CVE-2026-25734: Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Summary

Details

Impact

Technical Details

Remediation / Mitigation

Resources

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI