CVE-2026-41074: RT Ticket System CSRF Vulnerability

CVE-2026-41074 Overview

CVE-2026-41074 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Request Tracker (RT), an open source enterprise-grade issue and ticket tracking system maintained by Best Practical Solutions. The flaw exists in RT versions 6.0.0 through 6.0.2 and allows an attacker to trigger state-changing actions on behalf of an authenticated RT user. Exploitation requires the victim to visit an attacker-controlled web page while logged into RT. Best Practical released RT version 6.0.3 to remediate the issue. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker can hijack an authenticated session to perform arbitrary state-changing actions in RT, including ticket modification, configuration changes, and other privileged operations available to the victim.

Affected Products

Best Practical Request Tracker (RT) version 6.0.0
Best Practical Request Tracker (RT) version 6.0.1
Best Practical Request Tracker (RT) version 6.0.2

Discovery Timeline

2026-05-22 - CVE-2026-41074 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-41074

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) issue in RT versions 6.0.0 through 6.0.2. RT fails to adequately validate the origin or authenticity of state-changing HTTP requests. An attacker who lures an authenticated RT user to a malicious page can cause the user's browser to submit forged requests to the RT instance. The browser automatically includes the user's session cookies, so RT processes the requests as legitimate actions performed by the victim.

Because the attack abuses the trust RT places in the authenticated session, the attacker inherits the victim's permissions. This can include modifying tickets, changing user preferences, altering queue configuration, or escalating privileges if the victim is an administrator. No credentials are stolen, but the application state is changed under the victim's identity.

Root Cause

The root cause is missing or insufficient anti-CSRF protection on state-changing endpoints. RT did not consistently enforce a synchronizer token or equivalent mechanism that ties the request to the user's authenticated session. Without this binding, the server cannot distinguish a deliberate user action from a cross-origin forged request. The GitHub Security Advisory GHSA-265j-qx4w-256j documents the affected behavior.

Attack Vector

Exploitation is remote and requires user interaction. The attacker hosts a page containing a hidden form or JavaScript that issues a request to the target RT instance. When a logged-in RT user loads the page, the browser submits the request with the active session cookie. RT executes the action as if the user initiated it. The attacker must know the URL of the target RT deployment and the structure of the target endpoint. No authentication or prior privileges are required on the attacker side.

Refer to the GitHub Security Advisory GHSA-265j-qx4w-256j and the RT 6.0.3 release notes for technical details on the affected endpoints.

Detection Methods for CVE-2026-41074

Indicators of Compromise

HTTP POST or state-changing GET requests to RT endpoints with a Referer or Origin header pointing to an unrelated external domain.
Unexpected ticket modifications, status changes, or configuration updates correlated with a user loading external links or email content.
Spikes in RT audit log entries attributed to a single user within a short time window after that user visited external content.

Detection Strategies

Review the RT web server access logs for state-changing requests where the Referer header is missing or originates from an untrusted domain.
Correlate RT transaction history with proxy or web gateway logs to identify cross-origin requests targeting RT URLs.
Search email security telemetry for messages containing links to attacker-controlled pages sent to RT users prior to suspicious account activity.

Monitoring Recommendations

Enable verbose logging on the RT application server and forward logs to a centralized SIEM for correlation with browser and email telemetry.
Alert on anomalous bulk modifications performed by a single user account within a short interval.
Monitor for new outbound connections from user workstations to recently registered or low-reputation domains shortly before RT activity changes.

How to Mitigate CVE-2026-41074

Immediate Actions Required

Upgrade all RT instances running 6.0.0, 6.0.1, or 6.0.2 to RT version 6.0.3 or later.
Inventory RT deployments across the environment, including internal and customer-facing instances, before applying the patch.
Notify RT users to avoid clicking untrusted links while authenticated to RT until the upgrade is complete.

Patch Information

Best Practical Solutions released RT version 6.0.3 to fix the CSRF vulnerability. The fix is available from the official RT 6.0.3 release on GitHub. Administrators should follow the standard RT upgrade procedure, including database schema updates if applicable, and restart the web server after deployment.

Workarounds

Restrict access to RT to trusted networks using firewall rules or a VPN until the patch can be applied.
Require users to log out of RT when not actively using the application to reduce the window of exposure.
Deploy a web application firewall rule that rejects state-changing requests to RT lacking a same-origin Referer or Origin header.

bash

# Example: upgrade RT to the patched 6.0.3 release
cd /opt/rt6-src
git fetch --tags
git checkout rt-6.0.3
./configure --prefix=/opt/rt6
make install
make upgrade-database
systemctl restart rt-web