CVE-2026-41076: RT: LDAP authentication bypass via empty password

Published May 22, 2026
·
Updated

Last updated 6 July 2026

Other sources

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by reviewing their LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix.

— NVD

Affected Software

4 affected componentsFixes available
rt>5.0.9<=5.0.10
rt>=6.0.0<=6.0.2
debian/request-tracker4<=4.4.4+dfsg-2+deb11u3, <=4.4.4+dfsg-2+deb11u5, <=4.4.6+dfsg-1.1+deb12u3
4.4.6+dfsg-1.1+deb12u4
debian/request-tracker5<=5.0.3+dfsg-3~deb12u5, <=5.0.7+dfsg-4+deb13u2
5.0.3+dfsg-3~deb12u65.0.7+dfsg-4+deb13u35.0.10+dfsg-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/request-tracker4 to a version that resolves this vulnerability.

    Fixed in 4.4.6+dfsg-1.1+deb12u4
  2. Upgrade

    Upgrade debian/request-tracker5 to a version that resolves this vulnerability.

    Fixed in 5.0.3+dfsg-3~deb12u6Fixed in 5.0.7+dfsg-4+deb13u3Fixed in 5.0.10+dfsg-3
  3. Upgrade

    Upgrade RT to a version that resolves this vulnerability.

    Fixed in 5.0.10
  4. Upgrade

    Upgrade RT to a version that resolves this vulnerability.

    Fixed in 6.0.3
  5. Compensating control

    If developers are unable to upgrade immediately, review the LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts.

Event History

May 22, 2026
CVE Published
via MITRE·09:36 PM
Data Sourced
via MITRE·09:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeakness
Jul 7, 2026
Data Sourced
via Ubuntu·01:34 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·01:35 PM
DescriptionAffected Software
Data Sourced
via Launchpad·01:35 PM
Description

Frequently Asked Questions

1

What is the severity of CVE-2026-41076?

CVE-2026-41076 has a severity rating of 8.1, indicating a high level of risk.

2

How can I fix CVE-2026-41076?

To fix CVE-2026-41076, you should upgrade to Best Practical RT version 5.0.10 or later, or 6.0.3 or later.

3

What does CVE-2026-41076 exploit?

CVE-2026-41076 exploits an authentication bypass vulnerability via empty passwords in LDAP/AD configurations.

4

Which versions of RT are affected by CVE-2026-41076?

CVE-2026-41076 affects RT versions 5.0.9 and earlier, as well as versions 6.0.0 through 6.0.2.

5

What can attackers achieve with CVE-2026-41076?

An attacker can potentially bypass authentication and gain unauthorized access to the RT system with CVE-2026-41076.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203