CVE-2026-41075 Overview
CVE-2026-41075 is an SQL injection vulnerability [CWE-89] in Request Tracker (RT), an open source enterprise-grade issue and ticket tracking system maintained by Best Practical Solutions. The flaw affects RT versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2. An authenticated user can craft input that gets incorporated into database queries without proper validation. Successful exploitation allows attackers to read or modify data stored in the RT database. The vendor released fixed versions 5.0.10 and 6.0.3 to address the issue.
Critical Impact
Authenticated attackers can execute arbitrary SQL against the RT database, exposing ticket contents, user credentials, and administrative metadata while enabling unauthorized data modification.
Affected Products
- Best Practical Request Tracker (RT) versions 5.0.0 through 5.0.9
- Best Practical Request Tracker (RT) versions 6.0.0 through 6.0.2
- Deployments exposing RT to authenticated low-privilege users
Discovery Timeline
- 2026-05-22 - CVE-2026-41075 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-41075
Vulnerability Analysis
The vulnerability is a server-side SQL injection in RT's database query handling. RT incorporates user-supplied input into SQL statements without applying proper validation or parameterization. An authenticated account, regardless of role, can supply crafted parameters that alter query semantics. This breaks the intended trust boundary between application logic and the underlying database.
The issue is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Because RT typically runs against a backend such as PostgreSQL or MySQL holding ticket history, user accounts, queue configuration, and custom fields, the impact extends to confidentiality and integrity of all stored support data.
Root Cause
The root cause is missing or insufficient sanitization of user-controlled values that flow into dynamically constructed SQL queries. Affected code paths concatenate input into queries instead of using bound parameters. The fix, shipped in RT 5.0.10 and RT 6.0.3, tightens input handling in the affected query paths.
Attack Vector
Exploitation requires network access to the RT web interface and valid credentials for any RT account. The attacker submits crafted input through standard RT interfaces. The server processes the malicious payload as part of an SQL statement, yielding unauthorized read or write access to RT database tables. No user interaction beyond the attacker's own authenticated session is required.
No public proof-of-concept exploit has been disclosed at the time of publication. Technical specifics are limited to the GitHub Security Advisory GHSA-7vf8-xv7w-97c6.
Detection Methods for CVE-2026-41075
Indicators of Compromise
- Unexpected SQL syntax tokens such as UNION SELECT, --, ;, or encoded variants in RT web request parameters and POST bodies
- Anomalous database query patterns from the RT application user, including queries against Users, Tickets, or Principals tables outside normal RT workflows
- Spikes in database error log entries originating from the RT backend
- Authentication sessions that issue large numbers of search or query requests in rapid succession
Detection Strategies
- Enable RT request logging and review web server access logs for suspicious query parameters containing SQL metacharacters
- Deploy a web application firewall (WAF) with SQL injection signatures in front of the RT interface
- Configure database audit logging to record statements executed by the RT service account and alert on schema-level reads of credential tables
- Compare RT version output from /NoAuth/version or installation metadata against fixed releases 5.0.10 and 6.0.3
Monitoring Recommendations
- Forward RT application logs, web server logs, and database audit logs to a centralized SIEM for correlation
- Alert on RT accounts performing actions inconsistent with their role, such as low-privilege users triggering bulk record retrieval
- Track outbound network connections from the RT host to detect data exfiltration following a successful injection
How to Mitigate CVE-2026-41075
Immediate Actions Required
- Upgrade RT 5.x installations to version 5.0.10 and RT 6.x installations to version 6.0.3 without delay
- Audit existing RT user accounts and disable inactive, shared, or unnecessary accounts to reduce the authenticated attack surface
- Rotate database credentials and RT user passwords if exploitation is suspected based on log review
- Review database audit logs since the affected versions were deployed for unauthorized queries
Patch Information
Best Practical released RT 5.0.10 and RT 6.0.3 with the SQL injection fix. Administrators should follow the standard RT upgrade procedure, including database schema updates where applicable, and verify the version after deployment. Full advisory details are available in GHSA-7vf8-xv7w-97c6.
Workarounds
- Restrict RT account creation and access to trusted users only, as recommended by the vendor advisory
- Place RT behind a VPN or zero-trust access proxy to limit network reachability to authenticated corporate users
- Deploy WAF rules that block requests containing SQL injection patterns targeting RT endpoints
- Apply least privilege to the database account used by RT, removing rights to tables outside RT's required schema
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
