Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-77393

CVE-2026-77393: Ignition Gateway Auth Bypass Vulnerability

CVE-2026-77393 is an authentication bypass flaw in Ignition Gateway 8.1.53 and earlier that allows authenticated users to create unauthorized projects. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-77393 Overview

CVE-2026-77393 affects Inductive Automation Ignition version 8.1.53 and earlier. The Gateway Create Project Role(s) setting ships blank by default. This insecure default permits any authenticated user who can execute Gateway scripts to create new projects on the Ignition Gateway.

The flaw is classified under [CWE-276: Incorrect Default Permissions]. Ignition 8.1.54 remediates the issue by restricting project creation to Designer sessions and removing reliance on the misconfigured setting. The 8.3 release series is not affected.

Critical Impact

Authenticated users with Gateway script execution rights can create arbitrary projects, undermining project boundary controls in industrial control system (ICS) environments.

Affected Products

  • Inductive Automation Ignition 8.1.53 and earlier 8.1.x releases
  • Ignition Gateway component (Create Project Role(s) configuration)
  • Not affected: Ignition 8.3.x series

Discovery Timeline

  • 2026-09-04 - CVE-2026-77393 published to the National Vulnerability Database (NVD)
  • 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77393

Vulnerability Analysis

Ignition is an industrial application platform used to build supervisory control and data acquisition (SCADA) and human-machine interface (HMI) systems. The Gateway component manages project configuration, users, and roles across an operational technology (OT) deployment.

The Create Project Role(s) setting defines which authenticated roles are permitted to create new projects on the Gateway. In shipped configurations of 8.1.53 and earlier, this setting is blank. A blank value fails closed on role checks but is interpreted as "no restriction" for authenticated principals capable of invoking Gateway scripts.

Any authenticated user who can execute a Gateway script can therefore create projects. This bypasses the role-based access control (RBAC) boundary that operators expect the setting to enforce.

Root Cause

The root cause is an insecure default configuration. The shipped blank value for Create Project Role(s) does not enforce a restrictive policy. This matches [CWE-276], where a resource is created with permissions that grant broader access than intended.

Attack Vector

Exploitation requires network access to the Gateway and valid authenticated credentials with Gateway script execution privileges. No user interaction is required. An attacker meeting these prerequisites invokes Gateway scripting APIs to create arbitrary projects, which can be used to stage further tampering with HMI or SCADA workflows.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the CISA ICS Advisory ICSA-26-246-06 and the Inductive Automation Security Advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-77393

Indicators of Compromise

  • Unexpected new projects appearing on the Ignition Gateway outside of change-management windows
  • Gateway audit log entries showing project creation initiated from non-Designer sessions
  • Authenticated Gateway script executions from accounts that do not normally author projects

Detection Strategies

  • Review the Ignition Gateway audit log for project created events and correlate with the initiating user and session type
  • Baseline the list of projects on each Gateway and alert on additions
  • Monitor Gateway scripting API activity for calls related to project creation from unexpected user contexts

Monitoring Recommendations

  • Forward Ignition Gateway audit logs to a centralized log platform for retention and correlation
  • Alert on any project creation event that does not originate from a known Designer session
  • Track authentication events for accounts holding Gateway script execution rights and flag anomalous source addresses

How to Mitigate CVE-2026-77393

Immediate Actions Required

  • Upgrade Ignition to version 8.1.54 or later within the 8.1.x branch, or move to the unaffected 8.3.x series
  • Inventory all Ignition Gateways and confirm the Create Project Role(s) setting is populated with a restrictive role
  • Audit accounts that can execute Gateway scripts and remove privileges from users that do not require them
  • Review recent project creation events to confirm no unauthorized projects were introduced

Patch Information

Inductive Automation released Ignition 8.1.54, which restricts project creation to Designer sessions and no longer relies on the Create Project Role(s) setting. The 8.3 series does not contain the vulnerable behavior. Refer to the Inductive Automation Security Advisory and the GitHub CSAF Document for authoritative version guidance.

Workarounds

  • Populate the Gateway Create Project Role(s) setting with a restrictive role that only trusted engineering accounts hold
  • Restrict Gateway script execution privileges to a minimal set of administrative users
  • Place the Gateway behind network segmentation so only authorized engineering workstations can reach it
  • Enforce multi-factor authentication (MFA) on all accounts with access to the Gateway management interface

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne