The vulnerability identified as CVE-2026-41076 in the RT issue and ticket tracking system is an improper authentication flaw (CWE-287) affecting versions prior to 5.0.10 and versions 6.0.0 through 6.0.2. It allows an attacker to bypass authentication when RT is configured to use LDAP or Active Directory for user authentication, depending on certain LDAP server configurations. This enables unauthorized access as any LDAP-backed RT user without supplying valid credentials. The issue has been addressed in RT versions 5.0.10 and 6.0.3. If immediate upgrading is not possible, administrators can mitigate the risk by ensuring their LDAP server rejects unauthenticated bind attempts.

Successful exploitation allows an attacker to bypass authentication controls and gain unauthorized access to RT as any LDAP-backed user. This can lead to full compromise of confidentiality, integrity, and availability of the RT system and its data. The CVSS v3.1 base score is 8.1, indicating a high severity vulnerability with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction.

A fix is available in RT versions 5.0.10 and 6.0.3. Upgrading to these or later versions is the recommended remediation. If upgrading immediately is not feasible, administrators should review and adjust their LDAP server's authentication policies to reject unauthenticated bind attempts, which can serve as a temporary workaround. Patch status is confirmed by the vendor advisory embedded in the description.