CVE-2026-44231 Bestpractical CVE debrief

Who should care

System administrators and security teams responsible for Request Tracker installations should be aware of this vulnerability and take immediate action to patch or mitigate it. Additionally, users with administrative privileges in Request Tracker should be cautious of potential credential exposure.

Technical summary

CVE-2026-44231 is a critical vulnerability in the Request Tracker system, specifically affecting versions prior to 5.0.10 and 6.0.3. This vulnerability allows a privileged user, who is not an administrator, to obtain authentication credentials of other users, including those with administrative privileges. These credentials can then be used to read data as those users via RT's feed endpoints. The exploitation of this vulnerability also results in the rotation of credentials and the invalidation of previously distributed feed URLs across the instance.

Defensive priority

CVE-2026-44231 is rated CRITICAL with a CVSS score of 9.1, indicating a high severity vulnerability in Request Tracker that could allow for information disclosure and privilege escalation.

Recommended defensive actions

• Inventory and verify installed version of Request Tracker to determine if vulnerable.
• Apply patches or upgrade to version 5.0.10 or 6.0.3, or later.
• Restrict access to the REST 2.0 API to minimize exposure.
• Monitor for suspicious activity on feed endpoints.
• Rotate and invalidate previously distributed feed URLs across the instance.

Evidence notes

The vulnerability affects Request Tracker versions prior to 5.0.10 and 6.0.3, allowing a privileged user to obtain authentication credentials of other users, including administrative users, and use those credentials to read data via RT's feed endpoints.

Official resources