CVE-2026-41074

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. This issue has been fixed in version 6.0.3.

• CWE-352

• https://github.com/bestpractical/rt/releases/tag/rt-6.0.3
• https://github.com/bestpractical/rt/security/advisories/GHSA-265j-qx4w-256j

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41068Kyverno is a policy engine designed for cloud native platfor…7.7
• CVE-2026-41069libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-4107Zohocorp ManageEngine Exchange Reporter Plus versions before…5.4
• CVE-2026-41070openvpn-auth-oauth2 is a plugin/management interface client …10
• CVE-2026-41071libheif is a HEIF and AVIF file format decoder and encoder. …8.1
• CVE-2026-41073RT is an open source, enterprise-grade issue and ticket trac…4.6
• CVE-2026-41075RT is an open source, enterprise-grade issue and ticket trac…8.8
• CVE-2026-41076RT is an open source, enterprise-grade issue and ticket trac…8.1
• CVE-2026-41078OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6…5.9
• CVE-2026-41079OpenPrinting CUPS is an open source printing system for Linu…5.4
• CVE-2026-4108Zohocorp ManageEngine Exchange Reporter Plus versions before…4.8
• CVE-2026-41080libexpat before 2.8.0 uses insufficient entropy, and thus ha…2.9