6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25736

CVE-2026-25736: Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

Summary

A stored Cross-site Scripting (XSS) vulnerability was identified in the Custom RSE Attribute of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions.

Details

A stored XSS payload can be introduced via a custom RSE attribute value and is later rendered when the RSE is viewed.

Create Path:
Admin > RSE Management > RSE NAME > Add Attribute

Trigger Path:
Admin > RSE Management > RSE NAME

Request

POST /proxy/rses/WEB1/attr/XSS HTTP/1.1
...
{"value":"<script>alert('XSS')</script>"}

Response

HTTP/1.1 201 CREATED
...
Created

Storing XSS Payload in RSE Attribute <img width="1234" height="844" alt="Storing XSS Payload in RSE Attribute" src="https://github.com/user-attachments/assets/d10f58c2-8cea-43a9-bf7f-f94ef3d1fd81" />

XSS Payload triggering when viewing RSE <img width="1248" height="949" alt="XSS Payload triggering when viewing RSE" src="https://github.com/user-attachments/assets/d536fac2-ab44-4cfb-b669-085a8c3db33e" />

Impact

Any authenticated user who views affected resources may execute attacker-controlled JavaScript in the WebUI origin. Depending on the affected feature, this may impact all users or administrative users only.

The impact is amplified by:

Session cookies that are accessible to JavaScript (missing HttpOnly flag).
API tokens exposed to the WebUI via JavaScript variables.

An attacker would likely attempt to exfiltrate the session token to an external site by setting an encoded version of the cookie as the path of a GET request to an attacker controlled site (i.e ).

Miggo Vulnerability Database

→

CVE-2026-25736

CVE-2026-25736:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rucio-webui	pip	< 35.8.3	35.8.3
rucio-webui	pip	>= 36.0.0rc1, < 38.5.4	38.5.4
rucio-webui	pip	>= 39.0.0rc1, < 39.3.1	39.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the Rucio WebUI, specifically in the rendering of custom RSE attributes. An attacker can inject a malicious script as the value of an RSE attribute. When a user views the details of that RSE, the script is executed in the user's browser.

The analysis of the patches between the vulnerable and patched versions reveals that the vulnerability lies in the client-side JavaScript code that renders the RSE information. Specifically, the file lib/rucio/web/ui/static/rse.js contains several functions that were using insecure jQuery methods like .append() with string concatenation to build the HTML for the RSE details page. This allowed for the execution of any HTML, including <script> tags, that was stored in the RSE attributes.

The primary vulnerable functions identified are create_attributes_table, create_info_table, and create_protocol_table in lib/rucio/web/ui/static/rse.js. These functions are directly responsible for taking the RSE data from the server and rendering it on the page. The patches for these functions replace the insecure .append() calls with safer methods like .text(), which ensures that the data is treated as plain text and not as HTML, thus mitigating the XSS vulnerability. Other related files were also patched for similar XSS vulnerabilities as a preventive measure, but the core of the described vulnerability is in the rendering of the RSE attributes.

Vulnerable functions

create_attributes_table

lib/rucio/web/ui/static/rse.js

This function is responsible for rendering the custom attributes of an RSE. It was vulnerable to stored XSS because it used jQuery's `.append()` method with unsanitized data (`item` and `data[0][item]`) to construct HTML. An attacker could inject malicious HTML and JavaScript by creating a custom RSE attribute with a crafted name or value. The patch fixes this by using `.text()` to safely insert the data, ensuring it is treated as text and not as HTML.

create_info_table

lib/rucio/web/ui/static/rse.js

This function is responsible for rendering general information about an RSE. It was vulnerable to stored XSS for the same reason as `create_attributes_table`. It rendered RSE information using `.append()` with unsanitized data. The patch uses `.text()` to prevent the XSS.

create_protocol_table

lib/rucio/web/ui/static/rse.js

This function is responsible for rendering the protocol information of an RSE. It was also vulnerable to stored XSS. It rendered RSE protocol information using `.append()` with unsanitized data. The patch uses `.text()` to prevent the XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-25736: Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

Summary

Details

XSS Payload triggering when viewing RSE <img width="1248" height="949" alt="XSS Payload triggering when viewing RSE" src="https://github.com/user-attachments/assets/d536fac2-ab44-4cfb-b669-085a8c3db33e" />

Impact

CVE-2026-25736:

6.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

6.1

6.1

CVE-2026-25736: Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

Summary

Details

XSS Payload triggering when viewing RSE <img width="1248" height="949" alt="XSS Payload triggering when viewing RSE" src="https://github.com/user-attachments/assets/d536fac2-ab44-4cfb-b669-085a8c3db33e" />

Impact

Remediation / Mitigation

Resources

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI