PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41075 bestpractical CVE debrief

RT (Request Tracker) versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an authenticated SQL injection vulnerability. An attacker with valid credentials can supply crafted input that is incorporated into database queries without proper sanitization, potentially enabling unauthorized read or modification of data within the RT database. The vulnerability was disclosed on May 22, 2026, with a subsequent update to the CVE record on May 26, 2026. The issue has been remediated in RT versions 5.0.10 and 6.0.3.

Vendor
bestpractical
Product
rt
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-07-23
Advisory published
2026-05-22
Advisory updated
2026-07-23

Who should care

Organizations operating RT instances for issue and ticket tracking, particularly those with multi-user deployments where account compromise or insider threats are concerns. Security teams responsible for vulnerability management in open-source enterprise applications.

Technical summary

The vulnerability exists in RT's handling of user-supplied input that is incorporated into SQL queries without adequate validation or parameterization. Affected versions include 5.0.0-5.0.9 and 6.0.0-6.0.2. The CVSS 3.1 score of 8.8 reflects network attack vector, low attack complexity, low privileges required, and high impacts to confidentiality, integrity, and availability. Remediation is available through patched releases 5.0.10 and 6.0.3.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade RT installations to version 5.0.10 (for 5.x series) or 6.0.3 (for 6.x series) to remediate the SQL injection vulnerability.
  • If immediate patching is not feasible, restrict RT account access to trusted users only as a temporary mitigation measure.
  • Review database access logs for anomalous query patterns that may indicate exploitation attempts prior to patching.
  • Validate that input sanitization controls are functioning as expected after upgrade completion.

Evidence notes

The CVE description and NVD metadata confirm the vulnerability affects specific RT version ranges and has been assigned CWE-89 (SQL Injection). CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H supports the HIGH severity rating. GitHub Security Advisory GHSA-7vf8-xv7w-97c6 and corresponding release tags provide vendor acknowledgment and fix availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41075 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41075

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41075 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41075

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.