CVE-2026-92817

A flaw was found in Ignition. The Perspective module fails to properly validate session privileges when determining Designer-level access. An authenticated attacker with access to a Vision project can supply a valid session identifier to obtain elevated Designer privileges. This can be exploited to execute arbitrary code in the context of the Ignition Gateway process.

This vulnerability is rated as an Important impact because an authenticated attacker can elevate privileges to an administrative tier and achieve arbitrary code execution within the gateway environment, bypassing intended access boundaries. While this flaw presents significant risk to deployments running the Inductive Automation Ignition SCADA platform, Red Hat Enterprise Linux and OpenShift Container Platform ship the CoreOS Ignition provisioning utility, which does not include the affected Perspective or Vision services. Consequently, standard Red Hat environments do not expose the vulnerable functionality under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.