Threat reportVulnerabilityTL-2026-4882
Stored XSS vulnerabilities in Request Tracker and RT for Incident Response (CVE-2026-105454, CVE-2026-105455, CVE-2026-105456)
Stored XSS vulnerabilities in Request Tracker and RT for (TL-2026-4882) is a medium-severity software vulnerability, first published 2026-10-31. It has no confirmed attribution, affects Best Practical Solutions Request Tracker (RT), references 4 CVEs (CVE-2026-105454, CVE-2026-105455, CVE-2026-105456), maps to 6 MITRE ATT&CK techniques (T1059.007, T1185, T1190), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4882
- Threat ID
- TL-2026-4882
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How Stored XSS vulnerabilities in Request Tracker and RT for works
CERT Polska disclosed three cross-site scripting (CWE-79) vulnerabilities in Best Practical's Request Tracker (RT) and RT for Incident Response (RTIR). They allow script injection through unescaped URL linkification in ticket history, unescaped related-ticket subjects in RTIR incident creation/splitting forms, and an RTIR HTML scrubber that permits javascript: links. Unauthenticated email senders can plant the payloads.
On 30 October 2026 CERT Polska published an advisory (credit: Mateusz Szymaniec, CERT Polska) covering three XSS flaws in products from Best Practical Solutions. All three are classified CWE-79. The advisory does not state a CVSS score, exploitation in the wild, or public PoC availability, so none are asserted here.
CVE-2026-105454 (Request Tracker 5.0.0-5.0.11 and 6.0.0-6.0.4): RT's automatic URL linkification in HTML ticket content does not HTML-escape URLs. A URL crafted to break out of the link's address attribute can add a script that runs when the ticket history is displayed, with no further action by the viewer. Unauthenticated senders can exploit it by sending HTML email to publicly accessible queues, because inbound email becomes ticket content viewed by staff. The RT 6.0.4 release notes describe it as stored XSS via URLs in HTML ticket content.
CVE-2026-105455 (RTIR 6.0.0-6.0.4; RTIR 5.0 is unaffected): the ticket creation forms for splitting and for incident creation display the subjects of related tickets without HTML escaping. A script in the ticket subject runs when a user opens either form, which can compromise the session of an incident handler. The RTIR 6.0.4 release notes state unauthenticated users can exploit it through email submissions.
CVE-2026-105456 (RTIR 5.0.0-5.0.11 and 6.0.0-6.0.4): RTIR's HTML scrubber extension permits links with javascript: schemes (including ones containing internal link placeholders). Anyone who can add HTML content to a ticket, including unauthenticated email senders to the Incident Reports queue, can store such a link; it executes upon user interaction.
Best Practical released RT 6.0.4 and RTIR 6.0.4 on 29 October 2026. The RT 6.0.4 notes list more than 20 security fixes (a fetch of the page reported 26; an earlier read reported 25), including several other reflected and stored XSS issues, a template-bypass remote code execution fix, an authorization bypass in ticket forwarding, and an unauthenticated denial of service. They recommend all users upgrade as soon as possible, and require updated dependencies (MIME::Tools 5.522, HTML::Gumbo 0.19, Starlet 0.33, Mozilla::CA 20261020). RTIR's notes say to upgrade RT to the matching 6.0.4 release alongside RTIR. No 5.0.x companion release notes were found; the advisory lists 5.0.11 as both within the affected range and a fixed version, so administrators should confirm the exact patched 5.0.x build with the vendor.
Because RT/RTIR are used by SOC/CSIRT teams, stored XSS delivered by inbound email targets incident-response staff in their ticket workflow. Severity MEDIUM is an analyst placeholder, not a source value. No network IOCs, malware, or threat actor are named in the sources.
MITRE ATT&CK techniques used in TL-2026-4882
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204.001 User Execution: Malicious Link
Collection
T1185 Browser Session Hijacking
Initial Access
T1190 Exploit Public-Facing Application; T1566 Phishing
Credential Access
Affected products and versions in Stored XSS vulnerabilities in Request Tracker and RT for
- Best Practical Solutions — Request Tracker (RT)
Vulnerable versions: 5.0.0-5.0.11; 6.0.0-6.0.4
Fixed in: 5.0.11; 6.0.4 - Best Practical Solutions — RT for Incident Response (RTIR) - CVE-2026-105455
Vulnerable versions: 6.0.0-6.0.4
Fixed in: 6.0.4 - Best Practical Solutions — RT for Incident Response (RTIR) - CVE-2026-105456
Vulnerable versions: 5.0.0-5.0.11; 6.0.0-6.0.4
Fixed in: 5.0.11; 6.0.4
Remediation for Stored XSS vulnerabilities in Request Tracker and RT for
Patches
- RT 5.0.11 and 6.0.4 (CVE-2026-105454)
- RTIR 6.0.4 (CVE-2026-105455)
- RTIR 5.0.11 and 6.0.4 (CVE-2026-105456)
Immediate actions
- Upgrade Request Tracker to the fixed releases listed by CERT Polska (5.0.11 / 6.0.4)
- Upgrade RT for Incident Response to the fixed releases listed by CERT Polska (5.0.11 / 6.0.4), and upgrade RT to the matching version per the RTIR release notes
- Analyst guidance: review tickets received on public-facing queues (e.g. Incident Reports) for HTML emails containing javascript: links or unusual URLs until patched
Longer-term hardening
- Analyst guidance: keep RT/RTIR on the latest security release; RT 6.0.4 alone addresses more than 20 vulnerabilities
- Apply the required dependency updates listed in the RT 6.0.4 notes (MIME::Tools 5.522, HTML::Gumbo 0.19, Starlet 0.33, Mozilla::CA 20261020)
CVEs associated with Stored XSS vulnerabilities in Request Tracker and RT for
CVE-2026-105454, CVE-2026-105455, CVE-2026-105456, CVE-2026-6841
Weaknesses (CWE) in Stored XSS vulnerabilities in Request Tracker and RT for
Timeline of Stored XSS vulnerabilities in Request Tracker and RT for
- Best Practical released RT 6.0.3, RTIR 6.0.3 and RTIR 5.0.10, the prior security release (fixing other issues including CVE-2026-6841), the baseline before this disclosure.
- Best Practical released RTIR 6.0.4, fixing CVE-2026-105455 and CVE-2026-105456 (both reported by Mateusz Szymaniec / CERT Polska) and recommending RT 6.0.4 alongside.
- Best Practical released RT 6.0.4, addressing more than 20 security vulnerabilities including reflected and stored XSS in multiple areas, and urged all users to upgrade.
- CVE-2026-105456 published: RTIR HTML scrubber permits javascript: scheme links containing internal link placeholders (RTIR 5.0.0-5.0.11, 6.0.0-6.0.4).
- CVE-2026-105455 published: unescaped ticket subjects in RTIR incident creation/splitting forms (RTIR 6.0.0-6.0.4).
- CVE-2026-105454 published: RT URL auto-linking fails to escape HTML characters, enabling script injection in ticket history (RT 5.0.0-5.0.11, 6.0.0-6.0.4).
- CERT Polska published the advisory 'Vulnerabilities in Request Tracker and RT for Incident Response software' (credit: Mateusz Szymaniec).
Sources cited for Stored XSS vulnerabilities in Request Tracker and RT for
- Vulnerabilities in Request Tracker and RT for Incident Response software (CERT Polska)
- RT 6.0.4 Release Notes (Best Practical)
- RTIR 6.0.4 Release Notes (Best Practical)
- RTIR 5.0.10 Release Notes (Best Practical, prior release)
- RTIR 6.0.3 Release Notes (Best Practical, prior release)
- CERT Polska Coordinated Vulnerability Disclosure policy
- Best Practical - Request Tracker
- Best Practical - RT for Incident Response
- CWE-79: Improper Neutralization of Input During Web Page Generation (XSS)
- NVD - CVE-2026-6841 (earlier related Request Tracker XSS fixed in RT 6.0.3, context only)
Detection coverage for TL-2026-4882
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4882 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.