Vulnerability-Lookup

UBUNTU-CVE-2026-44231 (CVE-2026-44231)

Vulnerability from osv_ubuntu – Published: 2026-05-21 00:00 – Updated: 2026-07-29 07:57 – Source website

Details

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.

Severity

9.1 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-44231	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-44231	REPORT
	https://github.com/bestpractical/rt/releases/tag/…	REPORT
	https://ubuntu.com/security/notices/USN-8506-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "request-tracker4",
            "binary_version": "4.2.12-5"
          },
          {
            "binary_name": "rt4-apache2",
            "binary_version": "4.2.12-5"
          },
          {
            "binary_name": "rt4-clients",
            "binary_version": "4.2.12-5"
          },
          {
            "binary_name": "rt4-db-mysql",
            "binary_version": "4.2.12-5"
          },
          {
            "binary_name": "rt4-db-postgresql",
            "binary_version": "4.2.12-5"
          },
          {
            "binary_name": "rt4-db-sqlite",
            "binary_version": "4.2.12-5"
          },
          {
            "binary_name": "rt4-doc-html",
            "binary_version": "4.2.12-5"
          },
          {
            "binary_name": "rt4-fcgi",
            "binary_version": "4.2.12-5"
          },
          {
            "binary_name": "rt4-standalone",
            "binary_version": "4.2.12-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "request-tracker4",
        "purl": "pkg:deb/ubuntu/request-tracker4@4.2.12-5?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.11-2",
        "4.2.12-3",
        "4.2.12-4",
        "4.2.12-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "request-tracker4",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt4-apache2",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt4-clients",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt4-db-mysql",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt4-db-postgresql",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt4-db-sqlite",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt4-doc-html",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt4-fcgi",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt4-standalone",
            "binary_version": "4.4.2-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "request-tracker4",
        "purl": "pkg:deb/ubuntu/request-tracker4@4.4.2-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.4.1-5",
        "4.4.2-1",
        "4.4.2-2",
        "4.4.2-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "request-tracker4",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          },
          {
            "binary_name": "rt4-apache2",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          },
          {
            "binary_name": "rt4-clients",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          },
          {
            "binary_name": "rt4-db-mysql",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          },
          {
            "binary_name": "rt4-db-postgresql",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          },
          {
            "binary_name": "rt4-db-sqlite",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          },
          {
            "binary_name": "rt4-doc-html",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          },
          {
            "binary_name": "rt4-fcgi",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          },
          {
            "binary_name": "rt4-standalone",
            "binary_version": "4.4.3-2+deb10u3build0.20.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "request-tracker4",
        "purl": "pkg:deb/ubuntu/request-tracker4@4.4.3-2+deb10u3build0.20.04.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.4.3-2",
        "4.4.3-2+deb10u3build0.20.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "request-tracker4",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          },
          {
            "binary_name": "rt4-apache2",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          },
          {
            "binary_name": "rt4-clients",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          },
          {
            "binary_name": "rt4-db-mysql",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          },
          {
            "binary_name": "rt4-db-postgresql",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          },
          {
            "binary_name": "rt4-db-sqlite",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          },
          {
            "binary_name": "rt4-doc-html",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          },
          {
            "binary_name": "rt4-fcgi",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          },
          {
            "binary_name": "rt4-standalone",
            "binary_version": "4.4.4+dfsg-2ubuntu1.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "request-tracker4",
        "purl": "pkg:deb/ubuntu/request-tracker4@4.4.4+dfsg-2ubuntu1.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.4.4+dfsg-2ubuntu1",
        "4.4.4+dfsg-2ubuntu1.22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.1+dfsg-1ubuntu1+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.1+dfsg-1ubuntu1+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1+dfsg-1ubuntu1",
        "5.0.1+dfsg-1ubuntu1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "request-tracker4",
            "binary_version": "4.4.7+dfsg-1"
          },
          {
            "binary_name": "rt4-apache2",
            "binary_version": "4.4.7+dfsg-1"
          },
          {
            "binary_name": "rt4-clients",
            "binary_version": "4.4.7+dfsg-1"
          },
          {
            "binary_name": "rt4-db-mysql",
            "binary_version": "4.4.7+dfsg-1"
          },
          {
            "binary_name": "rt4-db-postgresql",
            "binary_version": "4.4.7+dfsg-1"
          },
          {
            "binary_name": "rt4-db-sqlite",
            "binary_version": "4.4.7+dfsg-1"
          },
          {
            "binary_name": "rt4-doc-html",
            "binary_version": "4.4.7+dfsg-1"
          },
          {
            "binary_name": "rt4-fcgi",
            "binary_version": "4.4.7+dfsg-1"
          },
          {
            "binary_name": "rt4-standalone",
            "binary_version": "4.4.7+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "request-tracker4",
        "purl": "pkg:deb/ubuntu/request-tracker4@4.4.7+dfsg-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.4.4+dfsg-2ubuntu1",
        "4.4.4+dfsg-2ubuntu2",
        "4.4.7+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.5+dfsg-2ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.5+dfsg-2ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1+dfsg-1ubuntu1",
        "5.0.5+dfsg-2",
        "5.0.5+dfsg-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "request-tracker4",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-apache2",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-clients",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-db-mysql",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-db-postgresql",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-db-sqlite",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-doc-html",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-fcgi",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-standalone",
            "binary_version": "4.4.7+dfsg-4syncable1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "request-tracker4",
        "purl": "pkg:deb/ubuntu/request-tracker4@4.4.7+dfsg-4syncable1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.4.7+dfsg-4syncable1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.7+dfsg-4"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.7+dfsg-4"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.7+dfsg-4"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.7+dfsg-4"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.7+dfsg-4"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.7+dfsg-4"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.7+dfsg-4"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.7+dfsg-4"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.7+dfsg-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.7+dfsg-4?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.7+dfsg-2",
        "5.0.7+dfsg-3",
        "5.0.7+dfsg-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "request-tracker4",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-apache2",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-clients",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-db-mysql",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-db-postgresql",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-db-sqlite",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-doc-html",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-fcgi",
            "binary_version": "4.4.7+dfsg-4syncable1"
          },
          {
            "binary_name": "rt4-standalone",
            "binary_version": "4.4.7+dfsg-4syncable1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "request-tracker4",
        "purl": "pkg:deb/ubuntu/request-tracker4@4.4.7+dfsg-4syncable1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.4.7+dfsg-4syncable1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.7+dfsg-6ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.7+dfsg-6ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.7+dfsg-4",
        "5.0.7+dfsg-6"
      ]
    }
  ],
  "aliases": [],
  "details": "RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users \u2014 including users with administrative privileges \u2014 and use those credentials to read data as those users via RT\u0027s feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.",
  "id": "UBUNTU-CVE-2026-44231",
  "modified": "2026-07-29T07:57:01Z",
  "published": "2026-05-21T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44231"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44231"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bestpractical/rt/releases/tag/rt-5.0.10"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8506-1"
    }
  ],
  "related": [
    "USN-8506-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-44231"
  ]
}

CVE-2026-44231 (GCVE-0-2026-44231)

Vulnerability from cvelistv5 – Published: 2026-07-20 19:20 – Updated: 2026-07-21 12:46

Title

RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

Summary

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 12:46 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-269 - Improper Privilege Management
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/bestpractical/rt/security/advi…	x_refsource_CONFIRM
https://github.com/bestpractical/rt/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
bestpractical	rt	Affected: < 5.0.10 Affected: >= 6.0.0, < 6.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44231",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T12:46:02.396679Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T12:46:48.161Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rt",
          "vendor": "bestpractical",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users \u2014 including users with administrative privileges \u2014 and use those credentials to read data as those users via RT\u0027s feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T19:20:43.950Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74"
        },
        {
          "name": "https://github.com/bestpractical/rt/releases/tag/rt-6.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bestpractical/rt/releases/tag/rt-6.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-7rx2-x357-wv74",
        "discovery": "UNKNOWN"
      },
      "title": "RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44231",
    "datePublished": "2026-07-20T19:20:43.950Z",
    "dateReserved": "2026-05-05T15:42:40.518Z",
    "dateUpdated": "2026-07-21T12:46:48.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

USN-8506-1 (UBUNTU-CVE-2026-6841)

Vulnerability from osv_ubuntu – Published: 2026-07-06 11:15 – Updated: 2026-07-24 12:43 – Source website

Summary

request-tracker5 vulnerabilities

Details

Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search "Page" URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-6841)

It was discovered that Request Tracker did not properly sanitize user- controlled data written to spreadsheet exports of search results. A remote attacker could possibly use this issue to conduct a spreadsheet (CSV/formula) injection attack, causing spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. (CVE-2026-41073)

It was discovered that Request Tracker did not properly validate input incorporated into database queries via the entry_aggregator parameter in JSON search. An authenticated user could possibly use this issue to perform SQL injection attacks and read or modify data in the RT database. (CVE-2026-41075)

It was discovered that Request Tracker contained an authentication bypass when configured to authenticate users against an LDAP or Active Directory server. Under certain LDAP server configurations, a remote attacker could possibly use this issue to authenticate as any LDAP-backed RT user without supplying valid credentials. (CVE-2026-41076)

It was discovered that Request Tracker served certain uploaded content inline rather than as an attachment. A remote attacker could possibly use this issue to conduct a cross-site scripting attack. (CVE-2026-44229)

It was discovered that Request Tracker did not properly sanitize input on search-results chart pages. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-44230)

Jeroen Gui discovered that Request Tracker did not properly restrict access to the REST 2.0 user collection endpoint. A privileged user could possibly use this issue to obtain authentication credentials belonging to other users, including administrators, resulting in privilege escalation and information disclosure. (CVE-2026-44231)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8506-1	ADVISORY
	https://ubuntu.com/security/CVE-2026-6841	REPORT
	https://ubuntu.com/security/CVE-2026-41073	REPORT
	https://ubuntu.com/security/CVE-2026-41075	REPORT
	https://ubuntu.com/security/CVE-2026-41076	REPORT
	https://ubuntu.com/security/CVE-2026-44229	REPORT
	https://ubuntu.com/security/CVE-2026-44230	REPORT
	https://ubuntu.com/security/CVE-2026-44231	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-6841",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41073",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41075",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41076",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44229",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44230",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44231",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.1+dfsg-1ubuntu1+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.1+dfsg-1ubuntu1+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.1+dfsg-1ubuntu1+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1+dfsg-1ubuntu1",
        "5.0.1+dfsg-1ubuntu1+esm1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-6841",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41073",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41075",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41076",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44229",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44230",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44231",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.5+dfsg-2ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.5+dfsg-2ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.5+dfsg-2ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.1+dfsg-1ubuntu1",
        "5.0.5+dfsg-2",
        "5.0.5+dfsg-2ubuntu0.1~esm1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-6841",
              "severity": [
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41073",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41075",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-41076",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44229",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44230",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-44231",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "request-tracker5",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-apache2",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-clients",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-mysql",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-postgresql",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-db-sqlite",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-doc-html",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-fcgi",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          },
          {
            "binary_name": "rt5-standalone",
            "binary_version": "5.0.7+dfsg-6ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "request-tracker5",
        "purl": "pkg:deb/ubuntu/request-tracker5@5.0.7+dfsg-6ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.7+dfsg-6ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.0.7+dfsg-4",
        "5.0.7+dfsg-6"
      ]
    }
  ],
  "aliases": [],
  "details": "Aleksander Iwicki discovered that Request Tracker did not properly sanitize\nthe search \"Page\" URL parameter. A remote attacker could possibly use this\nissue to conduct a reflected cross-site scripting attack. (CVE-2026-6841)\n\nIt was discovered that Request Tracker did not properly sanitize user-\ncontrolled data written to spreadsheet exports of search results. A remote\nattacker could possibly use this issue to conduct a spreadsheet\n(CSV/formula) injection attack, causing spreadsheet applications to\ninterpret crafted values as formulas or macros when the file is opened.\n(CVE-2026-41073)\n\nIt was discovered that Request Tracker did not properly validate input\nincorporated into database queries via the entry_aggregator parameter in\nJSON search. An authenticated user could possibly use this issue to perform\nSQL injection attacks and read or modify data in the RT database.\n(CVE-2026-41075)\n\nIt was discovered that Request Tracker contained an authentication bypass\nwhen configured to authenticate users against an LDAP or Active Directory\nserver. Under certain LDAP server configurations, a remote attacker could\npossibly use this issue to authenticate as any LDAP-backed RT user without\nsupplying valid credentials. (CVE-2026-41076)\n\nIt was discovered that Request Tracker served certain uploaded content\ninline rather than as an attachment. A remote attacker could possibly use\nthis issue to conduct a cross-site scripting attack. (CVE-2026-44229)\n\nIt was discovered that Request Tracker did not properly sanitize input on\nsearch-results chart pages. A remote attacker could possibly use this issue\nto conduct a reflected cross-site scripting attack. (CVE-2026-44230)\n\nJeroen Gui discovered that Request Tracker did not properly restrict access\nto the REST 2.0 user collection endpoint. A privileged user could possibly\nuse this issue to obtain authentication credentials belonging to other\nusers, including administrators, resulting in privilege escalation and\ninformation disclosure. (CVE-2026-44231)",
  "id": "USN-8506-1",
  "modified": "2026-07-24T12:43:31Z",
  "published": "2026-07-06T11:15:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8506-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-6841"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-41073"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-41075"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-41076"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44229"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44230"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-44231"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "request-tracker5 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2026-6841",
    "UBUNTU-CVE-2026-41073",
    "UBUNTU-CVE-2026-41075",
    "UBUNTU-CVE-2026-41076",
    "UBUNTU-CVE-2026-44229",
    "UBUNTU-CVE-2026-44230",
    "UBUNTU-CVE-2026-44231"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

UBUNTU-CVE-2026-44231 (CVE-2026-44231)

CVE-2026-44231 (GCVE-0-2026-44231)

USN-8506-1 (UBUNTU-CVE-2026-6841)

Tags

Sightings

Nomenclature

Related by attack behaviour