Request Tracker CVE-2026-41075

Exploitation requires (1) a valid authenticated session against the target RT instance - any privilege level suffices, including unprivileged self-service users since the CVSS vector specifies PR:L - and (2) network reachability to RT's web interface, specifically the JSON search functionality that accepts the entry_aggregator parameter. No user interaction by a second party is needed (UI:N), no special non-default configuration is required, and the affected feature is part of stock RT 5.0.0-5.0.9 and 6.0.0-6.0.2. Exploitation is limited by the need for credentials, so instances that disable self-registration and restrict accounts to vetted internal users meaningfully reduce the attack surface, though any insider or compromised low-privilege account still qualifies.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a network-reachable, low-complexity, low-privilege bug with full CIA impact - any valid RT account, including unprivileged self-service users, can trigger it remotely without user interaction. No EPSS score is provided and the CVE is not in CISA KEV, and no public exploit is identified at time of analysis, so real-world exploitation pressure is currently low. However, because RT is commonly internet-exposed for customer support and frequently allows self-registration or LDAP-backed authentication, the PR:L barrier is weak in practice; combined with the simultaneous disclosure of a privilege-escalation issue (CVE-2026-44231) and an LDAP auth bypass in the same release, defenders should treat this as a high-priority patch rather than a paper-tiger high-CVSS finding.

An attacker who holds (or self-registers) any RT login authenticates to the web interface, then issues a JSON search request whose entry_aggregator parameter contains a crafted SQL fragment; the injected SQL executes with RT's database role, letting the attacker exfiltrate ticket contents, password hashes, and API tokens or modify ACLs to escalate themselves to administrator. No public exploit code has been identified at time of analysis, but the bug class is well-understood and the injection point is named explicitly in the vendor release notes.