CVE-2026-77393: Inductive Automation Ignition Incorrect Default Permissions
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Inductive Automation Ignitionto a version that resolves this vulnerability.Fixed in 8.1.54 - Configuration
For Ignition 8.1.53 and earlier, populate the Gateway setting "Create Project Role(s)" (it shipped blank) so that only users holding the specified role(s) can create projects; set it to match your required "Designer Role".
Ignition Gateway (Gateway General Security Settings) Create Project Role(s) = match their Designer Role
Event History
Frequently Asked Questions
Which deployments are affected?
Ignition 8.1.53 and earlier are affected. Ignition 8.1.54 changes project creation behavior, and the 8.3 series is not affected.
What access does an attacker need?
An attacker needs an authenticated user account and the ability to execute gateway scripts. Under those conditions, the blank default for the Gateway "Create Project Role(s)" setting allowed project creation.
Are default configurations affected?
Yes. The issue stems from the setting shipping blank in affected 8.1 releases, which permitted any authenticated user meeting the gateway-script execution condition to create projects.
What can be done if upgrading is not immediately possible?
Restrict authenticated users' ability to execute gateway scripts and review access to the Gateway "Create Project Role(s)" setting. These controls address the conditions identified for unauthorized project creation.