Ignition: Incorrect Default Permissions Allow Unauthorized Project Creation

The vulnerability CVE-2026-77393 affects Inductive Automation Ignition 8.1.53 and earlier. A security setting shipped without configured roles allows authenticated users with access to Gateway scripts to create new projects, even if they are not assigned an authorized role.

The issue is rated high severity and can affect the confidentiality, integrity, and availability of impacted environments. It was initially disclosed on September 3, 2026. Inductive Automation fixed the vulnerability in Ignition 8.1.54, while the 8.3 series is not vulnerable.

The Empty Field That Removes the Role Requirement

The weakness affects the Gateway setting named “Create Project Role(s)”. In vulnerable versions, this field is empty by default. As a result, the system does not require membership in any role to authorize project creation.

This is not an error in the access control check itself. The check correctly enforces whatever is specified in the setting, but the default value contains no roles to validate.

The vulnerability is therefore classified as CWE-276 — Incorrect Default Permissions. This distinction is also relevant to mitigation: properly populating the field restores enforcement of the configured role.

To exploit this condition, an attacker must:

• have an authenticated account;
• be able to execute Gateway scripts;
• reach the system over the network.

No interaction from another person is required. The attack complexity is also considered low, and the required privileges are limited.

The assigned score is 8.8 out of 10 under CVSS 3.1, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The CVSS 4.0 score is 8.7, with the following vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerable Versions and the Change Introduced by the Patch

All versions of Inductive Automation Ignition up to and including 8.1.53 are affected. The fixed version is Ignition 8.1.54.

The situation can be summarized as follows:

Product	Versions	Status
Inductive Automation Ignition 8.1	<= 8.1.53	Vulnerable
Inductive Automation Ignition 8.1	8.1.54 and later	Fixed
Inductive Automation Ignition 8.3	Entire series	Not affected

The patch does more than assign a different default value. In Ignition 8.1.54, project creation is restricted to Designer sessions and no longer depends on the “Create Project Role(s)” setting.

The same logic is already implemented in the 8.3 series. As a result, installations in that branch are not exposed to CVE-2026-77393.

Administrators should verify the exact release installed on each Gateway. An inventory based only on the major “8.1” version is not sufficient: the critical distinction is between 8.1.53 and earlier and 8.1.54 and later.

Why Project Creation Is a Risk in Industrial Environments

Ignition is deployed worldwide and is associated with critical manufacturing, energy, and information technology environments. In these contexts, projects may contain components and logic connected to the automation processes managed by the platform.

An account with seemingly limited privileges, but authorized to execute Gateway scripts, could introduce a new project without having the role normally required for that operation. The impact depends on the specific installation and on the functionality available to the created project.

The CVSS assessment considers the potential impact on all three primary security objectives to be high:

• confidentiality, due to possible access to information that should not be available to the account;
• integrity, due to the ability to introduce unauthorized content or changes;
• availability, if the action interferes with the system’s proper operation.

No payloads, detailed exploitation procedures, or specific indicators of compromise have been disclosed. No public campaigns targeting this vulnerability are currently known.

CVE-2026-77393 is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Therefore, there is no associated catalog entry date or federal remediation deadline for this flaw. No recent prior entries involving Inductive Automation in KEV have been disclosed either.

This distinction matters: the vulnerability presents technically favorable conditions for exploitation, but based on the available information, it has not been identified as actively exploited.

Updates and Workaround for 8.1 Installations

The recommended measure is to upgrade to Ignition 8.1.54 or later. Alternatively, organizations can adopt the latest release in the 8.3 series, following the necessary compatibility checks.

When an immediate upgrade is not possible, organizations can apply the following workaround to earlier 8.1 versions:

1. Open the Gateway’s general security settings.
2. Locate the “Create Project Role(s)” field.
3. Configure it explicitly to match the Designer Role.
4. Use test accounts to verify that only users assigned the required role can create projects.

Fully configuring the field removes the specific condition described by CVE-2026-77393 because the authorization mechanism correctly enforces the specified roles.

Instructions for this parameter are available in the documentation for Gateway General Security Settings. Vendor updates can be found in the Inductive Automation Trust Center.

In the absence of public technical indicators, administrators should still review the list of existing projects and investigate any unexpected creations against internal procedures. The specific audit method depends on the logs and event retention configured in the installation.

Segmentation, Remote Access, and Response to Suspicious Events

CISA recommends avoiding direct Internet exposure of control systems. Gateways and other industrial components should be protected by firewalls and separated from corporate networks through a segmented architecture.

When remote access is essential, organizations should use an up-to-date VPN, while recognizing that a VPN alone is not sufficient protection. A vulnerable VPN or a compromised remote device could undermine the segmentation strategy.

Before modifying a production environment, the organization should assess the potential impact of the patch and workaround on industrial processes. Changes should also be supported by defense-in-depth controls, strict account management, and least-privilege restrictions on Gateway script execution.

Any suspicious activity should be handled according to internal incident response procedures and reported to CISA when appropriate. Phishing and social engineering also remain possible ways to obtain the authenticated account required for exploitation.

The vulnerability was reported by Christopher Lusk of North Echo Security Research. Elhussain Fathy, known as 0xSphinx, independently identified the issue and confirmed the effectiveness of the fix.