CVE-2026-92817
published 2026-10-14CVE-2026-92817: The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a…
PriorityP263high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.48%
41.5th percentile
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| inductive_automation | ignition | 8.1.0 – 8.1.54 | — |
| inductive_automation | ignition | 8.3.0 – 8.3.8 | — |
| inductiveautomation | ignition | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access.
ghsa_unreviewed·2026-10-14
CVE-2026-92817 [HIGH] CWE-863 The Ignition Perspective module does not properly validate session privileges when determining Designer-level access.
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
VulDB
Inductive Automation Ignition up to 8.1.54/8.3.8 Perspective privileges management (EUVD-2026-100758)
vuldb·2026-10-14·CVSS 8.8
CVE-2026-92817 [HIGH] Inductive Automation Ignition up to 8.1.54/8.3.8 Perspective privileges management (EUVD-2026-100758)
A vulnerability was found in Inductive Automation Ignition up to 8.1.54/8.3.8. It has been declared as very critical. This affects an unknown function of the component Perspective Module. Executing a manipulation can lead to improper privilege management.
This vulnerability is registered as CVE-2026-92817. It is possible to launch the attack remotely. No exploit is available.
It is recommended to upgrade the affected component.
Red Hat
Ignition: Ignition: Arbitrary code execution via improper session privilege validation
vendor_redhat·2026-10-13·CVSS 8.8
CVE-2026-92817 [HIGH] CWE-266 Ignition: Ignition: Arbitrary code execution via improper session privilege validation
Ignition: Ignition: Arbitrary code execution via improper session privilege validation
A flaw was found in Ignition. The Perspective module fails to properly validate session privileges when determining Designer-level access. An authenticated attacker with access to a Vision project can supply a valid session identifier to obtain elevated Designer privileges. This can be exploited to execute arbitrary code in the context of the Ignition Gateway process.
Package: ignition (Red Hat Enterprise Linux 10) - Affected
Package: ignition (Red Hat Enterprise Linux 9) - Affected
Package: ignition (Red Hat OpenShift Container Platform 4) - Affected
Package: openshift/ose-rhel-coreos-8 (Red Hat OpenShift Container Platform 4) - Affected
Package: openshift/ose-rhel-coreos-9 (Red Hat OpenShift Cont
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-92817 ignition: Ignition: Arbitrary code execution via improper session privilege validation [fedora-all]
bugzilla·2026-10-19·CVSS 8.8
CVE-2026-92817 [HIGH] CVE-2026-92817 ignition: Ignition: Arbitrary code execution via improper session privilege validation [fedora-all]
CVE-2026-92817 ignition: Ignition: Arbitrary code execution via improper session privilege validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
Bugzilla
CVE-2026-92817 Ignition: Ignition: Arbitrary code execution via improper session privilege validation
bugzilla·2026-10-13·CVSS 8.8
CVE-2026-92817 [HIGH] CVE-2026-92817 Ignition: Ignition: Arbitrary code execution via improper session privilege validation
CVE-2026-92817 Ignition: Ignition: Arbitrary code execution via improper session privilege validation
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
2026-10-14
Published