Read the docs
TI-2026-29713 Aliases CVE-2026-41075

RT: SQL injection via entry_aggregator parameter in JSON search

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by restricting RT account access to trusted users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix Fixed rt (bestpractical): 5.0.10, 6.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bestpracticalrt5.0.0 to before 5.0.10; 6.0.0 to before 6.0.35.0.10, 6.0.3Patch availableCNA
  • rt Vendorbestpractical Affected 5.0.0 to before 5.0.10; 6.0.0 to before 6.0.3 Fixed in 5.0.10, 6.0.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*——bestpractical
  • cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:* Versions — — ·bestpractical

Remediation

  • Fix · CNA rt (bestpractical) Fixed in 5.0.10, 6.0.3

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41075

References

Other 3

  • TI-2017-03862 The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x… CVSS 3.0HIGH 8.8
  • TI-2023-21864 Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information… CVSS 3.1HIGH 7.5
  • TI-2022-09372 Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. CVSS 3.1CRITICAL 9.1
  • TI-2022-09371 Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. CVSS 3.1CRITICAL 9.1
  • TI-2023-24078 Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a… CVSS 3.1HIGH 7.5
  • TI-2023-21865 Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information… CVSS 3.1HIGH 7.5
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences