Vulnerability · Published Feb 25, 2026 · Assigned by GitHub_M

CVE-2026-25138Rucio WebUI has Username Enumeration via Login Error Message

Medium 5.3

In plain English

A medium-severity security flaw in rucio from rucio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 68.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	rucio-webui	35.8.3	GHSA-38wq-6q2w-hcf9
PyPI	rucio-webui	38.5.4	GHSA-38wq-6q2w-hcf9
PyPI	rucio-webui	39.3.1	GHSA-38wq-6q2w-hcf9
PyPI	rucio-webui	35.8.3, 38.5.4, 39.3.1	PYSEC-2026-3053

Affected products (as reported)

Vendor	Product	Versions
rucio	rucio	< 35.8.3>= 36.0.0rc1, < 38.5.4>= 39.0.0rc1, < 39.3.1

Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9 x_refsource_CONFIRM
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages x_refsource_MISC
https://github.com/rucio/rucio/releases/tag/35.8.3 x_refsource_MISC
https://github.com/rucio/rucio/releases/tag/38.5.4 x_refsource_MISC
https://github.com/rucio/rucio/releases/tag/39.3.1 x_refsource_MISC