CVE-2026-41076
HighSummary
RT is an issue and ticket tracking system that contains an authentication bypass vulnerability in versions 5.0.9 and prior, as well as 6.0.0 through 6.0.2. Under certain LDAP server configurations, an attacker may authenticate as any LDAP-backed RT user without supplying valid credentials.
Risk Assessment
This vulnerability may lead to unauthorized access to user accounts, posing a significant threat to data security within the organization.
Recommendation
It is recommended to upgrade to versions 5.0.10 or 6.0.3 as soon as possible. If an upgrade is not feasible, review the LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts.
Original NVD description (English source)
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by reviewing their LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix.