CVE-2026-105410

Executive Summary

CVE-2026-105410 is a stored cross-site scripting (XSS) vulnerability affecting Tuleap Enterprise Edition versions 17.0 through 17.5. An authenticated attacker with low privileges can inject script code that executes in the browser session of other users who view the affected content, potentially leading to session hijacking, data theft, or actions performed on behalf of the victim. With no vendor patch currently available, organizations running affected versions remain at risk and should prioritize compensating controls.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting). The NVD description states that the flaw is a stored XSS issue in Tuleap Enterprise Edition. Stored XSS occurs when user-supplied input is persisted by the application and later rendered in a web page without adequate output encoding or input sanitization. In this case, an attacker can submit malicious script content through an input vector that Tuleap does not properly neutralize, and that content is subsequently stored (for example, in a comment, project description, or other persistent field). When another user views the page containing the stored content, the script executes in the context of that user's browser session.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) indicates the following characteristics: the attack is network-accessible (AV:N), requires low attack complexity (AC:L), requires the attacker to have low privileges (PR:L) — meaning an authenticated account is needed — and requires user interaction (UI:R), i.e., the victim must view the malicious content. The scope is changed (S:C), meaning the vulnerability in the vulnerable component can impact resources beyond its security scope, reflecting the browser-context execution. The confidentiality and integrity impacts are high (C:H/I:H), while availability is not affected (A:N). This aligns with a classic stored XSS scenario where an attacker can read sensitive data and perform unauthorized actions as the victim.

The exact input field or functionality within Tuleap that is vulnerable is not specified in the NVD description. No public proof-of-concept, exploit code, or Nuclei template is available. The vulnerability is not listed in CISA KEV, and EPSS has not yet scored it. Patch confidence is 0/4, indicating no patch evidence from tracked sources. As of the time of writing, no vendor fix or workaround has been identified.

Exploitation Scenarios

The attack chain for this stored XSS vulnerability can be described at the vulnerability-class level, as specific implementation details (e.g., exact endpoint or parameter names) are not provided in the available intelligence.

1. Reconnaissance and target identification: The attacker identifies a Tuleap Enterprise Edition instance running version 17.0 through 17.5. This could be done via network scanning, Shodan queries (e.g., http.title:"Tuleap"), or manual discovery. The attacker needs a valid low-privileged account to proceed.

2. Triggering the flaw class: The attacker authenticates with low privileges and locates an input field that is persisted and later displayed to other users. Given the stored nature, this could be a field such as a project description, issue comment, or user profile field. The attacker submits a payload containing malicious JavaScript. Because the application fails to properly sanitize or encode the input, the script is stored in the application's backend.

3. Payload/execution method: When another user (e.g., an administrator or project member) views the page containing the stored content, the attacker's JavaScript executes in the victim's browser within the context of the Tuleap application. The payload could be designed to steal session cookies (if not HttpOnly), perform actions on behalf of the user (e.g., modify project settings, add users), or exfiltrate sensitive data. The specific payload is at the attacker's discretion and depends on the context of the vulnerable field.

4. Post-exploitation impact: Successful exploitation allows the attacker to execute arbitrary script code in the victim's browser session. This can lead to full compromise of the victim's account, unauthorized access to data, and potential lateral movement within the Tuleap instance. The high confidentiality and integrity impact reflects the potential for data theft and modification. Because the scope is changed, the attacker might also be able to pivot to other users or systems accessible via the victim's session.

No public PoC is available; the attack chain is inferred from the vulnerability class and the CVSS vector.

Impact Assessment

The business impact of CVE-2026-105410 is significant for organizations using affected Tuleap Enterprise Edition versions. Tuleap is a collaborative platform used for project management, issue tracking, and software development, often containing sensitive intellectual property, credentials, and internal communications. A stored XSS vulnerability can be exploited by an authenticated attacker with minimal privileges to compromise other users, including administrators. This could result in unauthorized access to project data, theft of session tokens, modification of critical configurations, and potential introduction of further malicious content.

The CVSS score of 8.7 (High) reflects the high confidentiality and integrity impacts, network attack vector, low complexity, and the need for user interaction. The scope change (S:C) indicates that the vulnerable component (Tuleap) can affect resources beyond its security scope, such as the victim's browser or other integrated systems. The blast radius depends on the number of users who view the stored content and their privileges. In a typical enterprise deployment, this could include project managers, developers, and administrators, leading to a wide-reaching compromise.

Since no patch is available, the risk is elevated. Organizations should assume that exploitation is possible and implement mitigation strategies.

Detection Guidance

Sigma Rule

title: Stored XSS in Tuleap Enterprise Edition
id: 5f8c2b1e-3a4d-4c5e-9f7a-1b2c3d4e5f6a
status: experimental
description: Detects potential stored XSS attempts against Tuleap Enterprise Edition by monitoring for suspicious script tags in HTTP requests.
author: Threat Intelligence Team
date: 2026-05-22
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  condition: selection
falsepositives:
  - Legitimate use of script tags in rich text editors (rare)
level: high
tags:
  - attack.t1189
  - cve.2026.105410

YARA Rule

rule CVE_2026_105410_Stored_XSS_Tuleap
{
    meta:
        description = "Detects stored XSS payloads targeting Tuleap Enterprise Edition"
        author = "Threat Intelligence Team"
        date = "2026-05-22"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105410"
        cve = "CVE-2026-105410"
    strings:
        $s1 = "<script" nocase
        $s2 = "javascript:" nocase
        $s3 = "onerror=" nocase
        $s4 = "onload=" nocase
        $s5 = "document.cookie" nocase
        $s6 = "XMLHttpRequest" nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105410 Tuleap Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"<script"; http_client_body; nocase; sid:1000001; rev:1; reference:cve,2026-105410; classtype:web-application-attack;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ network where http.request.method == "POST" and http.request.body contains "<script" ]
  [ network where http.response.status_code == 200 and http.request.method == "GET" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_query="*<script*" OR uri_query="*%3Cscript*" OR form_data="*<script*"
| stats count by src_ip, uri, user, status
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100100" level="12">
    <if_sid>31100</if_sid>
    <url>\.*</url>
    <match>script|javascript:|onerror=|onload=</match>
    <description>CVE-2026-105410: Possible Stored XSS attempt against Tuleap Enterprise Edition</description>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Since no official patch is available, implement a web application firewall (WAF) with rules to detect and block XSS payloads targeting Tuleap. Focus on script tags, event handlers, and JavaScript URIs in request parameters.
   • Enforce strict Content Security Policy (CSP) headers to mitigate the impact of XSS. A policy such as default-src 'self'; script-src 'self' 'unsafe-inline' can help prevent execution of injected scripts, though 'unsafe-inline' may be required for Tuleap functionality. Audit and restrict as much as possible.
   • Restrict user privileges to the minimum necessary. Limiting the ability to post content that is viewed by others can reduce the attack surface.
   • Enable HttpOnly and Secure flags on session cookies to prevent session theft via JavaScript.
   • Monitor for suspicious activity and unusual script content in application logs.

2. Patch/upgrade steps:

   • Monitor the Tuleap security advisories and vendor channels for an official patch. Once released, apply it immediately.
   • If a patched version becomes available, upgrade to the latest fixed version. Given that 17.0 through 17.5 are affected, the fix is likely in a version beyond 17.5.
   • Subscribe to CVE feeds and vendor notifications for updates.

3. Long-term hardening:

   • Implement secure coding practices, including output encoding and input validation, across the development lifecycle.
   • Conduct regular security assessments and vulnerability scans of Tuleap and other web applications.
   • Deploy a runtime application self-protection (RASP) solution if feasible.
   • Train developers and administrators on XSS risks and mitigation techniques.
   • Adopt a defense-in-depth strategy with segmentation and least privilege to limit the impact of any future vulnerabilities.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105410
• Tuleap Security Advisories: https://www.tuleap.org/security (monitor for updates)
• CWE-79: https://cwe.mitre.org/data/definitions/79.html
• OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• CVSS 3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-105410 at this time.