CVE-2025-54064: Rucio Information Disclosure Vulnerability

CVE-2025-54064 Overview

CVE-2025-54064 is an information disclosure vulnerability in the Rucio helm-charts for the rucio-server, rucio-ui, and rucio-webui components. Rucio is a software framework used to organize, manage, and access large volumes of scientific data. The default Apache access log format includes the X-Rucio-Auth-Token request header, causing user credentials to be written to log files on every request. Exposed tokens include internal Rucio tokens and JSON Web Tokens (JWT) issued through OpenID Connect (OIDC) authentication. The issue is classified under [CWE-532: Insertion of Sensitive Information into Log File].

Critical Impact
Any operator or reader with access to Apache access logs can harvest partial or complete Rucio authentication tokens and impersonate legitimate users.

Affected Products

Rucio rucio-server helm-chart versions prior to 37.0.2, 35.0.1, and 32.0.1
Rucio rucio-ui helm-chart versions prior to 37.0.4, 35.0.1, and 32.0.2
Rucio rucio-webui helm-chart versions prior to 37.0.2, 35.1.1, and 32.0.1

Discovery Timeline

2025-07-17 - CVE-2025-54064 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54064

Vulnerability Analysis

The Rucio helm-charts ship with an Apache logFormat variable that references the X-Rucio-Auth-Token HTTP request header. Apache writes this header value into the access log for every incoming request. Because Rucio clients transmit their authentication token in this header on each API call, the log file accumulates a continuous record of user credentials.

Tokens are frequently truncated in the log entries because of their length, and this is especially true for JWTs. Truncated tokens may not be directly usable as replay credentials, but they still constitute sensitive material that should never be persisted to disk. Internal Rucio tokens that fit within the log field length are captured in full and can be replayed by anyone who reads the log.

The impact scales with log distribution. Many Rucio deployments forward Apache access logs to shared observability stacks, ticketing systems, or archival storage where audiences extend well beyond instance administrators. This vulnerability affects confidentiality only; it does not directly enable code execution or data modification.

Root Cause

The root cause is an insecure default in the helm-chart templates. The chart authors included %{X-Rucio-Auth-Token}i (or an equivalent reference) in the Apache LogFormat directive without recognizing that this header carries a bearer credential rather than a benign correlation identifier.

Attack Vector

Exploitation does not require an attacker to interact with the Rucio API directly. Anyone with read access to the Apache access logs, whether through the pod filesystem, a mounted volume, a log shipper, a SIEM index, or a downstream analytics platform, can extract tokens from log lines. A user who obtains a valid token can then call the Rucio API as the token owner and access data governed by that identity.

The vulnerability does not require authentication to the Rucio service itself for the initial credential harvest; it requires access to log data produced by legitimate user traffic. The affected code path is in the helm-chart deployment configuration rather than in Rucio application code.

Detection Methods for CVE-2025-54064

Indicators of Compromise

Apache access log lines from rucio-server, rucio-ui, or rucio-webui pods containing string fragments that resemble Rucio tokens or JWT structures (three base64url segments separated by dots).
Unexpected API calls from source IPs that differ from the IP that originally received the token in an authentication response.
Reuse of a token from a network location or user agent that does not match prior sessions for the same principal.

Detection Strategies

Grep the running Apache access logs for eyJ (the common JWT header prefix in base64url) and for known Rucio token prefixes to confirm exposure.
Audit log-shipping pipelines and downstream indexes (Elasticsearch, Loki, S3, SIEM) for archived copies of exposed tokens that require sanitization.
Correlate Rucio authentication events with subsequent API activity to identify tokens used from anomalous sources.

Monitoring Recommendations

Alert on any Apache log record from Rucio components that contains an Authorization or X-Rucio-Auth-Token value after remediation.
Track access to log storage locations and restrict read permissions to a minimal administrator group.
Enable short token lifetimes and monitor for token reuse patterns that suggest replay from log-derived credentials.

How to Mitigate CVE-2025-54064

Immediate Actions Required

Upgrade the Rucio helm-charts to a patched release: rucio-server 37.0.2, 35.0.1, or 32.0.1; rucio-ui 37.0.4, 35.0.1, or 32.0.2; rucio-webui 37.0.2, 35.1.1, or 32.0.1.
Rotate all Rucio authentication tokens issued while the vulnerable configuration was active, including OIDC-issued JWTs.
Purge or sanitize existing Apache access logs and any downstream copies in log aggregation systems.
Restrict access to historical log archives until remediation is verified.

Patch Information

Updated helm-charts remove the X-Rucio-Auth-Token field from the default Apache logFormat. The fix was retrofitted to all supported Rucio Long Term Support (LTS) release lines. Refer to the GitHub Security Advisory GHSA-cmfq-f2v2-vj33 for full patch details and version guidance.

Workarounds

Override the logFormat value in the helm-chart configuration and remove any reference to X-Rucio-Auth-Token.
Filter or redact the X-Rucio-Auth-Token header at a log-processing layer before entries reach persistent storage.
Reduce token lifetimes to shrink the exploitation window for any credential material already written to logs.

bash

# Configuration example: override logFormat in values.yaml to exclude the auth token
httpd:
  logFormat: '%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"'