High severity · published May 22, 2026
CVE-2026-41076
RT: LDAP authentication bypass via empty password
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by reviewing their LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RT
rt · bestpractical
< 5.0.10; >= 6.0.0, < 6.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41076
github.com
https://github.com/bestpractical/rt/releases/tag/rt-5.0.10
github.com
https://github.com/bestpractical/rt/releases/tag/rt-6.0.3
github.com
https://github.com/bestpractical/rt/security/advisories/GHSA-3w28-fmcr-mjjx
More from rt
9.1
CVE-2026-44231
RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
8.8
CVE-2026-41075
RT: SQL injection via entry_aggregator parameter in JSON search
7.1
CVE-2026-41074
RT has broken CSRF protection for authenticated users
6.1
CVE-2026-44230
RT: Reflected Cross-Site Scripting in search results chart
6.1
CVE-2026-44227
RT: Reflected Cross-Site Scripting via URL parameters