CVE-2026-44230
Received Received - Intake

Reflected XSS in RT Issue Tracking System

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-44230
EUVD
EUVD-2026-46080

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
bestpractical rt From 5.0.4 (inc) to 5.0.10 (exc)
bestpractical rt From 6.0.0 (inc) to 6.0.3 (exc)
bestpractical request_tracker to 5.0.10 (exc)
bestpractical request_tracker to 6.0.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44230 is a reflected Cross-Site Scripting (XSS) vulnerability in RT, an issue and ticket tracking system. It affects versions 5.0.4 to 5.0.9 and 6.0.0 to 6.0.2. An attacker can exploit this by tricking an authenticated user into visiting a crafted URL, which executes arbitrary JavaScript in the user's browser session.

Detection Guidance

Detecting this vulnerability requires checking the installed version of RT. Compare your RT version against the affected ranges (5.0.4 to 5.0.9 or 6.0.0 to 6.0.2). Use commands like 'rt --version' or check the version in the RT web interface.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in your browser when you visit a specially crafted RT URL. This could lead to session hijacking, data theft, or unauthorized actions performed on your behalf while logged into RT.

Compliance Impact

This reflected XSS vulnerability could potentially expose organizations to compliance risks under GDPR and HIPAA by enabling attackers to steal session cookies or sensitive data via malicious scripts. Such breaches may lead to unauthorized access to personal or health information, violating data protection requirements.

Mitigation Strategies

Upgrade RT to version 5.0.10 or 6.0.3 immediately. Avoid visiting untrusted RT URLs until the upgrade is complete. There are no effective workarounds besides upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44230. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart