CVE-2026-44228: RT Issue Tracking System XSS Vulnerability

CVE-2026-44228 Overview

CVE-2026-44228 is a stored Cross-Site Scripting (XSS) vulnerability in Request Tracker (RT), an open source enterprise-grade issue and ticket tracking system maintained by Best Practical. The flaw affects RT versions 6.0.0 through versions prior to 6.0.3. User-controlled data is rendered in the RT web interface without proper HTML escaping, allowing an authenticated user with permission to set the affected data to inject JavaScript. The injected payload executes in the browser of any other RT user who subsequently views the affected page. The vulnerability is tracked under [CWE-79] and has been resolved in RT version 6.0.3.

Critical Impact
An authenticated attacker can inject persistent JavaScript that executes in other users' browsers, enabling session theft, action forgery within RT, and pivot opportunities against privileged operators.

Affected Products

Best Practical Request Tracker (RT) version 6.0.0
Best Practical Request Tracker (RT) versions above 6.0.0 and prior to 6.0.3
Deployments exposing RT ticket data entry to authenticated users

Discovery Timeline

2026-07-20 - CVE-2026-44228 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-44228

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the RT web interface. RT persists user-supplied field data and later renders it into HTML pages viewed by other users. In the affected code path, RT emits this data without applying HTML entity escaping, so browser-interpretable markup submitted by an attacker survives storage and is delivered inline to viewers.

Because the payload is persistent, it executes in the context of the RT origin every time a targeted page is loaded. An attacker can steal session cookies, invoke authenticated RT actions on behalf of the victim, modify ticket state, or exfiltrate ticket contents. Exploitation requires the attacker to hold an RT account with permission to set the affected data and requires a second RT user to view the page.

Root Cause

The root cause is missing output-side HTML escaping when RT templates render specific user-controlled fields. The application trusts stored input during rendering rather than encoding it for the HTML context. This maps directly to [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation is network-based against the RT web application. The attacker authenticates to RT, submits a crafted value into the vulnerable field, and waits for another user, often an agent or administrator, to view the affected ticket or page. The payload then executes with the victim's RT privileges. The scope changes because script executes in the browser origin under the victim's session, expanding impact beyond the attacker's own account.

No verified public proof-of-concept exploit code is available. See the GitHub Security Advisory GHSA-pfgp-5j8g-phgc for vendor technical details.

Detection Methods for CVE-2026-44228

Indicators of Compromise

Ticket fields, custom field values, or other RT-stored content containing <script>, onerror=, onload=, or javascript: sequences.
RT audit log entries showing edits to affected fields immediately followed by page views from higher-privileged accounts.
Unexpected outbound HTTP requests from operator browsers to attacker-controlled domains shortly after loading an RT page.

Detection Strategies

Query the RT database for stored field values containing HTML tag characters or common XSS payload keywords.
Enable and monitor Content Security Policy (CSP) violation reports from the RT origin to surface inline script execution attempts.
Correlate RT authentication logs with browser telemetry to identify session activity that does not match user working patterns.

Monitoring Recommendations

Forward RT web server access and application logs to a centralized analytics platform and alert on suspicious POST bodies to ticket update endpoints.
Monitor for anomalous privileged actions in RT, such as permission changes or bulk ticket edits, following a low-privilege user's field update.
Track browser process telemetry on operator workstations for script-driven credential access or cookie exfiltration.

How to Mitigate CVE-2026-44228

Immediate Actions Required

Upgrade all RT instances running 6.0.0 or later to version 6.0.3 without delay.
Audit existing ticket data, custom fields, and other user-controlled inputs for stored payloads containing HTML or JavaScript.
Rotate session cookies and force reauthentication for RT users after patching to invalidate any hijacked sessions.

Patch Information

Best Practical has fixed the issue in RT version 6.0.3. Upgrade artifacts and release notes are available at the GitHub RT Release 6.0.3 page. Advisory details are published in the GitHub Security Advisory GHSA-pfgp-5j8g-phgc.

Workarounds

Restrict permissions on fields identified in the vendor advisory so only trusted users can set the affected data until patching is complete.
Deploy a strict Content Security Policy on the RT origin that blocks inline scripts and disallows untrusted script sources.
Place RT behind a web application firewall configured to inspect and block HTML and JavaScript payloads in ticket update requests.

bash

# Configuration example: upgrade RT to the patched release
git clone https://github.com/bestpractical/rt.git
cd rt
git checkout rt-6.0.3
./configure --prefix=/opt/rt6
make testdeps
make install
make upgrade