CVE-2026-44230: RT Ticket Tracking System XSS Vulnerability

CVE-2026-44230 Overview

CVE-2026-44230 is a reflected Cross-Site Scripting (XSS) vulnerability in Request Tracker (RT), the open source enterprise-grade issue and ticket tracking system maintained by Best Practical Solutions. The flaw affects RT versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3. An attacker who can lure an authenticated RT user into visiting a crafted URL can execute arbitrary JavaScript within that user's browser session. The issue is tracked under [CWE-79] and was fixed in RT 5.0.10 and 6.0.3.

Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in the context of an authenticated RT session, enabling ticket data theft, action hijacking, and session abuse against helpdesk and support workflows.

Affected Products

Best Practical Request Tracker (RT) 5.0.4 through 5.0.9
Best Practical Request Tracker (RT) 6.0.0 through 6.0.2
Deployments serving authenticated RT users through a web browser

Discovery Timeline

2026-07-20 - CVE-2026-44230 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-44230

Vulnerability Analysis

CVE-2026-44230 is a reflected Cross-Site Scripting (XSS) issue in the RT web interface. Attacker-supplied input contained in a crafted URL is echoed back into an RT response without adequate output encoding or contextual sanitization. When an authenticated RT user renders that response, the injected payload executes inside the origin of the RT application. Because RT ties user permissions and session state to that origin, script execution effectively runs with the victim's privileges. The condition requires user interaction, which is consistent with a reflected rather than a stored XSS pattern.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. One or more RT request handlers reflect request parameters into HTML, JavaScript, or attribute contexts without applying the correct encoding for that sink. The GitHub Security Advisory GHSA-p724-v26h-32g9 documents the affected code paths and the corrective changes shipped in 5.0.10 and 6.0.3.

Attack Vector

Exploitation is network-based and requires no privileges on the RT instance, but it does require user interaction. An attacker crafts a URL that targets the vulnerable RT endpoint and embeds a JavaScript payload. The attacker then delivers the URL through phishing email, a ticket comment, a chat message, or any channel likely to reach an authenticated RT user. When the victim clicks the link, RT reflects the payload into the rendered page and the browser executes it. Typical post-exploitation actions include exfiltrating ticket contents, issuing authenticated API requests as the victim, altering ticket state, or pivoting to other RT users through further ticket-borne payloads.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-p724-v26h-32g9 for authoritative technical details.

Detection Methods for CVE-2026-44230

Indicators of Compromise

RT web server access logs containing request parameters with HTML or JavaScript syntax such as <script, onerror=, onload=, javascript:, or URL-encoded variants like %3Cscript.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after an RT page load.
Anomalous authenticated RT API activity originating from a legitimate user session shortly after a link click.

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects RT query strings and POST bodies for reflected XSS patterns and blocks or alerts on matches.
Enable and monitor Content Security Policy (CSP) violation reports from the RT origin to surface injected inline scripts and unauthorized external script sources.
Correlate RT access logs with browser telemetry to identify users who loaded URLs containing suspicious parameters shortly before anomalous ticket activity.

Monitoring Recommendations

Ingest RT web server, application, and audit logs into a centralized SIEM and alert on parameter values that resemble script payloads.
Track ticket modification and search API calls per user to detect bursts of authenticated actions consistent with session abuse.
Monitor outbound egress from workstations for connections to newly registered or low-reputation domains referenced by RT-hosted pages.

How to Mitigate CVE-2026-44230

Immediate Actions Required

Upgrade RT to version 5.0.10 or 6.0.3, matching your existing major release branch.
Instruct RT users, especially administrators and privileged agents, to avoid clicking RT links from untrusted sources until the upgrade is complete.
Review recent RT audit and access logs for suspicious parameter content or unexpected privileged actions.

Patch Information

Best Practical fixed the issue in RT 5.0.10 and RT 6.0.3. Release details are published in the GitHub RT Release Notes and the GitHub Security Advisory GHSA-p724-v26h-32g9. Administrators on the 5.0.x branch should apply 5.0.10, and administrators on the 6.0.x branch should apply 6.0.3.

Workarounds

Enforce a strict Content Security Policy on the RT origin that disallows inline scripts and restricts script sources to trusted, first-party locations.
Deploy WAF rules in front of RT that block requests containing HTML tags, event handler attributes, or javascript: schemes in query parameters.
Restrict RT access to authenticated users on trusted networks or behind a VPN to reduce the exposure surface for phishing-delivered payloads.

bash

# Example nginx snippet enforcing a restrictive CSP for the RT origin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;