Executive Summary
Fedora has issued a significant security update for the Request Tracker (RT) platform on Fedora 43, resolving seven distinct vulnerabilities: CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44229, CVE-2026-44230, and CVE-2026-44231. Request Tracker is a critical infrastructure component for many SOCs and incident response teams, often containing highly sensitive information including credentials, PII, and incident timelines.
The vulnerabilities typically span injection, cross-site scripting (XSS), and information disclosure. Because RT is often internet-facing and integrates with mail gateways (rt-mailgate) and directory services, it represents a high-value target for adversaries seeking to compromise internal IR workflows or gain initial access via the web stack.
While there is no confirmed in-the-wild exploitation at this time, the release of patches increases the risk of patch-diffing by threat actors. Organizations using RT, particularly those on Fedora 43, should prioritize updating to version 5.0.10 and auditing their environments for signs of post-exploitation activity.