CVE-2026-41076

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.9 and prior in addition to 6.0.0 through 6.0.2 contain an authentication bypass vulnerability in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. This issue has been fixed in versions 5.0.10 and 6.0.3. If developers are unable to upgrade immediately, they can temporarily work around this issue by reviewing their LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix.

• CWE-287

• https://github.com/bestpractical/rt/releases/tag/rt-5.0.10
• https://github.com/bestpractical/rt/releases/tag/rt-6.0.3
• https://github.com/bestpractical/rt/security/advisories/GHSA-3w28-fmcr-mjjx

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4107Zohocorp ManageEngine Exchange Reporter Plus versions before…5.4
• CVE-2026-41070openvpn-auth-oauth2 is a plugin/management interface client …10
• CVE-2026-41071libheif is a HEIF and AVIF file format decoder and encoder. …8.1
• CVE-2026-41073RT is an open source, enterprise-grade issue and ticket trac…4.6
• CVE-2026-41074RT is an open source, enterprise-grade issue and ticket trac…7.1
• CVE-2026-41075RT is an open source, enterprise-grade issue and ticket trac…8.8
• CVE-2026-41078OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6…5.9
• CVE-2026-41079OpenPrinting CUPS is an open source printing system for Linu…5.4
• CVE-2026-4108Zohocorp ManageEngine Exchange Reporter Plus versions before…4.8
• CVE-2026-41080libexpat before 2.8.0 uses insufficient entropy, and thus ha…2.9
• CVE-2026-41081Improper Handling of TLS Client Authentication Failure Leadi…6.5
• CVE-2026-41082In OCaml opam before 2.5.1, a .install field containing a de…7.8