CVE-2026-41075

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerability. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by restricting RT account access to trusted users.

• CWE-89

• https://github.com/bestpractical/rt/releases/tag/rt-5.0.10
• https://github.com/bestpractical/rt/releases/tag/rt-6.0.3
• https://github.com/bestpractical/rt/security/advisories/GHSA-7vf8-xv7w-97c6

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41069libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-4107Zohocorp ManageEngine Exchange Reporter Plus versions before…5.4
• CVE-2026-41070openvpn-auth-oauth2 is a plugin/management interface client …10
• CVE-2026-41071libheif is a HEIF and AVIF file format decoder and encoder. …8.1
• CVE-2026-41073RT is an open source, enterprise-grade issue and ticket trac…4.6
• CVE-2026-41074RT is an open source, enterprise-grade issue and ticket trac…7.1
• CVE-2026-41076RT is an open source, enterprise-grade issue and ticket trac…8.1
• CVE-2026-41078OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6…5.9
• CVE-2026-41079OpenPrinting CUPS is an open source printing system for Linu…5.4
• CVE-2026-4108Zohocorp ManageEngine Exchange Reporter Plus versions before…4.8
• CVE-2026-41080libexpat before 2.8.0 uses insufficient entropy, and thus ha…2.9
• CVE-2026-41081Improper Handling of TLS Client Authentication Failure Leadi…6.5