Request Tracker CVE-2026-41076

RT must be configured with the LDAP or Active Directory authentication backend (RT::Authen::ExternalAuth or equivalent), and the upstream LDAP/AD server must accept unauthenticated or anonymous bind requests as successful authentications - a non-default but historically common directory configuration. The attacker must know a valid RT username that exists in the LDAP-backed user store; no password, MFA, or prior session is required, and no user interaction is needed. Exploitation is limited to deployments meeting both conditions: RT versions 5.0.9-or-earlier or 6.0.0/6.0.1/6.0.2, AND a permissive LDAP bind policy. Instances using RT's internal password store, SSO/SAML, or LDAP servers that strictly reject unauthenticated binds are not exploitable. The CVSS AC:H rating reflects this dependency on the LDAP server's configuration rather than on attacker skill.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H signals network-reachable, unauthenticated exploitation yielding full confidentiality, integrity, and availability impact - consistent with logging in as any user including administrators. Attack Complexity is rated High because the vulnerability depends on the configuration of the upstream LDAP/AD server (specifically whether it honors unauthenticated bind), not solely on RT itself; this materially limits the population of exploitable instances. No EPSS score, KEV listing, or public POC was provided, so this is no public exploit identified at time of analysis and not confirmed actively exploited. The realistic priority is high for organizations whose AD/LDAP policies permit unauthenticated binds (a common legacy default), and lower for those whose directories already enforce strict bind requirements - but defenders should not rely on LDAP-side hardening alone given the severity of full account impersonation. EPSS and exploit-maturity data are missing from the inputs and should be re-checked.

An external attacker who knows or guesses a valid RT username (often discoverable from ticket emails, public mailing lists, or staff directory pages) submits that username with an empty or specially crafted password to RT's login form; when the backend LDAP server treats the bind as anonymous and returns success, RT issues a session as that user. By targeting an administrator account, the attacker gains full access to every ticket, attachment, and queue, and can pivot to internal systems referenced in tickets. No public POC is identified at time of analysis, but the technique is well-documented in general LDAP bypass literature and trivial to reproduce against vulnerable configurations.