VulnerabilityPublished 17 Jul 2025

CVE-2025-54064: rucio helm-charts · Sensitive Data in Logs

Affects rucio helm-chartsSource CVE Database V5

Not known to be exploited · CVSS 6.9 Medium · fixed in 37.0.2 : update rucio helm-charts when convenient.

Data as of 26 Oct 2026, 14:05 UTC

CVSS 4.0 base score

6.9Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 37.0.2, 35.0.1, 32.0.1 +3

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: Low
Vulnerable system integrity: None
Vulnerable system availability: None
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Vulnerable System.
Vulnerable system integrity: None: There is no loss of integrity within the Vulnerable System.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade rucio/helm-charts/rucio-server to 37.0.2, 35.0.1 or 32.0.1; rucio/helm-charts/rucio-ui to 37.0.4, 35.0.1 or 32.0.2; rucio/helm-charts/rucio-webui to 37.0.2, 35.1.1 or 32.0.1.

Affected software

Product	Affected	Fixed in
GitHubrucio/helm-charts/rucio-server`pkg:github/rucio/helm-charts/rucio-server`Other threats	Affected <32.0.1 <35.0.1 <37.0.2	Fixed in 32.0.1 35.0.1 37.0.2
GitHubrucio/helm-charts/rucio-ui`pkg:github/rucio/helm-charts/rucio-ui`Other threats	Affected <32.0.2 <35.0.1 <37.0.4	Fixed in 32.0.2 35.0.1 37.0.4
GitHubrucio/helm-charts/rucio-webui`pkg:github/rucio/helm-charts/rucio-webui`Other threats	Affected <32.0.1 <35.1.1 <37.0.2	Fixed in 32.0.1 35.1.1 37.0.2

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

European organizations using Rucio should promptly upgrade to the patched versions of rucio-server, rucio-ui, and rucio-webui helm-charts as specified (rucio-server 32.0.1+, rucio-ui 32.0.2+, rucio-webui 32.0.1+). If immediate upgrading is not feasible, administrators should manually modify the helm-chart configuration to remove the X-Rucio-Auth-Token from the Apache access log format variable (`logFormat`). Additionally, organizations should audit access controls on log storage to ensure only authorized personnel can view logs. Implementing log management best practices such as encryption at rest, strict access controls, and regular log review can reduce exposure risk. Monitoring for unusual access patterns or token misuse can help detect exploitation attempts. Finally, organizations should educate administrators and developers about the risks of logging sensitive information and enforce secure logging policies across all services.

Description

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The common Rucio helm-charts for the `rucio-server`, `rucio-ui`, and `rucio-webui` define the log format for the apache access log of these components. The `X-Rucio-Auth-Token`, which is part of each request header sent to Rucio, is part of this log format. Thus, each access log line potentially exposes the credentials (Internal Rucio token, or JWT in case of OIDC authentication) of the user. Due to the length of the token (Especially for a JWT) the tokens are often truncated, and thus not usable as credential; nevertheless, the (partial) credential should not be part of the logfile. The impact of this issue is amplified if the access logs are made available to a larger group of people than the instance administrators themselves. An updated release has been supplied for the `rucio-server`, `rucio-ui` and `rucio-webui` helm-chart. The change was also retrofitted for the currently supported Rucio LTS releases. The patched versions are rucio-server 37.0.2, 35.0.1, and 32.0.1; rucio-ui 37.0.4, 35.0.1, and 32.0.2; and rucio-webui 37.0.2, 35.1.1, and 32.0.1. As a workaround, one may update the `logFormat` variable and remove the `X-Rucio-Auth-Token`.

Impact

For European organizations, particularly research institutions, universities, and scientific collaborations that rely on Rucio for data management, this vulnerability poses a risk of credential leakage through log files. Unauthorized access to these tokens could allow attackers to impersonate legitimate users, gaining access to sensitive scientific data or administrative functions. This could lead to data confidentiality breaches, unauthorized data manipulation, or disruption of scientific workflows. The impact is amplified in environments where access logs are shared broadly or insufficiently protected. Given the collaborative nature of many European scientific projects, exposure of tokens could also facilitate lateral movement across interconnected systems. While the vulnerability does not directly allow remote code execution or system takeover, the compromise of authentication tokens can undermine the integrity and confidentiality of critical data assets. The medium severity rating reflects the moderate but tangible risk to confidentiality without direct impact on availability or integrity of the system itself.

Summary

CVE-2025-54064 is a medium-severity vulnerability affecting the Rucio software framework's helm-chart configurations for the rucio-server, rucio-ui, and rucio-webui components. Rucio is widely used for managing and accessing large volumes of scientific data, often in research and academic environments. The vulnerability arises from the inclusion of the X-Rucio-Auth-Token HTTP header in the Apache access log format defined by the helm-charts. This header carries sensitive authentication credentials, either internal Rucio tokens or JWTs in the case of OIDC authentication. Logging these tokens exposes sensitive credential information in plaintext within access logs. Although JWT tokens are often truncated due to their length, partial tokens still represent sensitive information that should not be logged. The risk is heightened if access logs are accessible to personnel beyond trusted administrators, potentially leading to unauthorized access or token misuse. The vulnerability affects multiple versions of the rucio-server, rucio-ui, and rucio-webui prior to patched releases (rucio-server 32.0.1, 35.0.1, 37.0.2; rucio-ui 32.0.2, 35.1.1, 37.0.4; rucio-webui 32.0.1, 35.1.1, 37.0.2). The issue is classified under CWE-532 (Insertion of Sensitive Information into Log File). The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, no privileges or user interaction required, and limited confidentiality impact. No known exploits are reported in the wild as of publication. Mitigation involves updating to patched helm-chart versions or manually removing the X-Rucio-Auth-Token from the log format configuration to prevent sensitive token logging.

CWE-532Insertion of Sensitive Information into Log File (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A09:2025: Security Logging & Alerting Failures (opens in a new tab)
The product writes sensitive information to a log file.
Architecture and Design · Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Distribution
Remove debug log files before deploying the application into production.
Operation
Protect log files against unauthorized read/write.
OWASP Cheat Sheets
Application Logging Vocabulary (opens in a new tab)
Logging (opens in a new tab)
OWASP ASVS 4.0.3
V7.1.1 (opens in a new tab)
V7.1.2 (opens in a new tab)
V8.3.5 (opens in a new tab)
Attack patterns
Fuzzing for application mapping (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

github.com/rucio/helm-charts/security/advisories/GHSA-cmfq-f2v2-vj33 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 17 Jul 2025, 15:01 UTC

WeaknessesCWE-532

Technical details

References

Community reviews

Related threats