CVE-2026-41076: RT Ticket System Auth Bypass Vulnerability

CVE-2026-41076 Overview

CVE-2026-41076 is an authentication bypass vulnerability in Request Tracker (RT), an open source enterprise-grade issue and ticket tracking system from Best Practical Solutions. The flaw affects RT versions 5.0.9 and prior, as well as 6.0.0 through 6.0.2, when configured to use LDAP or Active Directory (AD) for user authentication. Under specific LDAP server configurations, an attacker can authenticate as any LDAP-backed RT user without supplying valid credentials. The issue is fixed in RT versions 5.0.10 and 6.0.3. The vulnerability is tracked under CWE-287: Improper Authentication.

Critical Impact
Attackers can authenticate as arbitrary LDAP-backed RT users without valid credentials, gaining access to confidential tickets, customer data, and administrative functions.

Affected Products

Best Practical Request Tracker (RT) versions 5.0.9 and earlier
Best Practical Request Tracker (RT) versions 6.0.0 through 6.0.2
RT deployments configured to authenticate users via LDAP or Active Directory

Discovery Timeline

2026-05-22 - CVE-2026-41076 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-41076

Vulnerability Analysis

The vulnerability stems from how RT delegates user authentication to an external LDAP or Active Directory server. RT performs an LDAP bind operation using credentials supplied by the user during login. When the underlying LDAP server permits unauthenticated bind operations, the directory treats certain bind requests as anonymous lookups rather than authentication attempts. RT misinterprets the successful bind response as proof that the user supplied valid credentials.

This logic error allows an attacker to log in as any RT account backed by LDAP. The attacker only needs to know a valid username, which is often discoverable through ticket metadata, email headers, or directory enumeration. After authentication, the attacker inherits the full privileges of the impersonated account, including any administrative roles assigned within RT.

Root Cause

The root cause is improper validation of LDAP bind results [CWE-287]. RT's authentication routine does not distinguish between an authenticated bind and an unauthenticated bind accepted by a permissive LDAP server. RFC 4513 specifies that LDAP servers may accept bind requests with a distinguished name but an empty password as anonymous, yet some directories return success codes that applications can confuse with authenticated sessions.

Attack Vector

Exploitation requires network access to the RT login interface and knowledge of a target username. The attacker submits a login request containing the target username and a crafted password value that triggers an unauthenticated bind on the backend LDAP server. If the directory is configured to accept such binds, RT grants the attacker an authenticated session as the target user. No prior credentials, user interaction, or local access are required.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-3w28-fmcr-mjjx.

Detection Methods for CVE-2026-41076

Indicators of Compromise

LDAP server logs showing bind operations with empty or unusual password fields followed by successful RT session creation.
RT login events for privileged users from unexpected source IP addresses or geolocations.
Audit log entries showing ticket access, permission changes, or queue modifications by accounts not currently in active use.

Detection Strategies

Correlate RT authentication success events with the corresponding LDAP bind requests and inspect the bind credentials passed to the directory.
Compare RT login timestamps against known user activity windows and flag sessions established outside normal patterns.
Enable verbose logging in RT's authentication module to capture the bind result codes returned by the LDAP server.

Monitoring Recommendations

Forward RT web server logs and LDAP/AD authentication logs to a centralized SIEM or data lake for cross-correlation.
Alert on RT administrative actions performed by accounts that recently authenticated from new IP addresses.
Review RT session and ticket access logs for any LDAP-backed user accounts during the exposure window.

How to Mitigate CVE-2026-41076

Immediate Actions Required

Upgrade RT to version 5.0.10 or 6.0.3 immediately. These releases contain the official fix.
Audit LDAP and Active Directory server configuration to confirm that unauthenticated bind requests are rejected.
Review RT authentication and audit logs for unauthorized session activity since the vulnerable version was deployed.
Rotate credentials and re-validate permissions for any RT accounts that show suspicious authentication events.

Patch Information

Best Practical released fixed versions on the official RT GitHub repository. See the RT v5.0.10 release notes and the RT v6.0.3 release notes for upgrade instructions and changelog details. Upgrading is the recommended remediation path.

Workarounds

Reconfigure the LDAP or Active Directory server to reject unauthenticated bind attempts, per RFC 4513 guidance.
Restrict network access to the RT login interface to trusted networks while planning the upgrade.
Consider temporarily switching to an alternative authentication backend, such as internal RT password authentication, until the patch is applied.

bash

# Example: disable unauthenticated binds on OpenLDAP slapd.conf
# Add the following directive to reject anonymous and unauthenticated binds
disallow bind_anon
require authc