CVE-2026-44227: RT Ticket System Reflected XSS Vulnerability

CVE-2026-44227 Overview

CVE-2026-44227 is a reflected Cross-Site Scripting (XSS) vulnerability in Request Tracker (RT), an open source enterprise-grade issue and ticket tracking system maintained by Best Practical. The flaw affects RT versions 6.0.0 through 6.0.2 and is fixed in version 6.0.3. An attacker who convinces an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript within that user's browser session. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. No effective workarounds exist beyond patching or avoiding untrusted RT links.

Critical Impact
Successful exploitation enables session hijacking, ticket data theft, and unauthorized actions performed under the identity of the targeted RT user.

Affected Products

Best Practical Request Tracker (RT) 6.0.0
Best Practical Request Tracker (RT) 6.0.1
Best Practical Request Tracker (RT) 6.0.2

Discovery Timeline

2026-07-20 - CVE-2026-44227 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-44227

Vulnerability Analysis

CVE-2026-44227 is a reflected XSS vulnerability in the RT web interface. RT includes user-supplied input from a crafted URL in a rendered response without sufficient output encoding. When an authenticated user loads the malicious link, the browser executes attacker-controlled JavaScript in the RT origin.

Because the payload runs inside an authenticated session, the attacker inherits the victim's permissions within RT. This allows theft of session cookies, extraction of ticket contents, modification of queues, or issuing privileged actions if the victim is an administrator. The flaw requires user interaction and no attacker privileges on the target application.

Root Cause

The root cause is improper neutralization of user-controlled input reflected in HTTP responses generated by RT versions 6.0.0 through 6.0.2. The affected code paths fail to apply context-appropriate HTML or JavaScript escaping before returning attacker-supplied values to the browser. See the GitHub Security Advisory GHSA-7742-fhq7-ggv9 for the vendor-published technical details.

Attack Vector

Exploitation follows the classic reflected XSS pattern. The attacker crafts a URL pointing at the victim's RT instance with a malicious payload embedded in a parameter. The attacker delivers the URL through email, chat, an internal ticket comment, or another social channel. When an authenticated RT user clicks the link, the RT server reflects the payload into the rendered page and the browser executes it in the RT origin.

The attack requires a logged-in target, so RT deployments accessible only to authenticated staff remain exploitable through targeted phishing of ticket agents and administrators.

Detection Methods for CVE-2026-44227

Indicators of Compromise

RT access logs showing requests with unusual query string content such as <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E).
Outbound HTTP requests from RT user browsers to unknown domains immediately after loading an RT URL.
Unexpected ticket modifications, permission changes, or session cookie use from anomalous IP addresses.

Detection Strategies

Inspect web server and reverse-proxy logs for RT request URIs containing HTML tag characters or common XSS payload signatures.
Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution originating from the RT origin.
Correlate RT authentication events with subsequent high-privilege actions to identify session misuse following a suspicious URL click.

Monitoring Recommendations

Alert on RT users clicking externally sourced links that point back to the internal RT hostname with query parameters containing script-like content.
Monitor for new or unusual browser sessions initiating administrative RT API calls shortly after link-based referrals.
Enable and retain detailed RT audit logging for ticket, queue, and user modifications to support post-incident review.

How to Mitigate CVE-2026-44227

Immediate Actions Required

Upgrade all RT instances running versions 6.0.0 through 6.0.2 to RT 6.0.3 or later without delay.
Advise RT users, especially privileged agents and administrators, to avoid following untrusted RT URLs until patching is complete.
Rotate RT session secrets and force reauthentication after upgrading to invalidate any sessions potentially abused before the fix.

Patch Information

Best Practical resolved the issue in RT 6.0.3. Download details and release notes are available in the RT 6.0.3 Release on GitHub. Administrators should follow the standard RT upgrade procedure and verify the installed version after deployment.

Workarounds

No effective workaround exists per the vendor advisory; patching to RT 6.0.3 is the only complete remediation.
As a temporary risk-reduction measure, restrict RT web access to trusted networks or VPN users to limit exposure of unpatched instances.
Deploy a strict Content Security Policy on the RT origin to reduce the impact of reflected script execution while upgrades are scheduled.

bash

# Example strict CSP header to reduce XSS impact on RT
# Apply in the reverse proxy fronting RT (e.g., nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;