VulnerabilityDeferred

CVE-2026-41074

Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability.

HIGH 7.1EPSS 0.12%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. This issue has been fixed in version 6.0.3.

CVSS 3.1: 7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
EPSS: 0.12% probability · 2th percentile
CISA KEV: Not listed
Weakness: CWE-352
Source: security-advisories@github.com

References

https://github.com/bestpractical/rt/releases/tag/rt-6.0.3
https://github.com/bestpractical/rt/security/advisories/GHSA-265j-qx4w-256j

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.