CVE-2026-44229 Bestpractical CVE debrief

Who should care

RT users and administrators, especially those with versions 5.0.0 to 5.0.9 and 6.0.0 to 6.0.2, should apply patches immediately to prevent exploitation. Authenticated users with content upload permissions are at risk of being exploited, and all users who view or download uploaded content may be affected. Security teams and vulnerability management teams should prioritize patching and monitor for suspicious activity.

Technical summary

CVE-2026-44229 is a Cross-Site Scripting (XSS) vulnerability in RT, an open-source issue and ticket tracking system. The vulnerability allows an authenticated user to upload content with JavaScript that can be executed in the browser sessions of other users who view or download the content. This issue affects RT versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3. Fixes are available in versions 5.0.10 and 6.0.3. The vulnerability has a CVSS score of 5.4 and is rated MEDIUM.

Defensive priority

CVE-2026-44229 is rated MEDIUM with a CVSS score of 5.4. Authenticated users can exploit this vulnerability to execute JavaScript in the browser sessions of other users who view or download uploaded content. Immediate attention is advised for RT users to apply patches.

Recommended defensive actions

• Apply patches in versions 5.0.10 and 6.0.3 or later
• Restrict content upload permissions to trusted users
• Monitor for suspicious uploads and user activity
• Implement additional security measures such as Content Security Policy (CSP)
• Educate users about safe browsing practices
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-44229 issue affects RT versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3. An authenticated user can upload content with JavaScript that executes in the browser session of any RT user who later views or downloads it. Fixes are available in versions 5.0.10 and 6.0.3. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.