CVE-2026-19851

Executive Summary

CVE-2026-19851 is a Use of Default Password vulnerability affecting Tuleap Enterprise Edition versions 17.0 through 17.5, enabling an attacker to gain unauthorized access to user accounts created during XML import. The vulnerability stems from accounts imported via XML that leverage default passwords, which an attacker can leverage to access accounts without valid credentials. The estimated risk is elevated (CVSS 7.7), largely driven by the high confidentiality and integrity impacts, although the attack requires a successful brute-force attempt against imported accounts, significantly raising the attack complexity. No public PoC or patch is currently available, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Affected entities include Tuleap Enterprise Edition users running versions 17.0 through 17.5 who perform XML imports, creating user accounts either with default credentials or without forced password rotation. The primary risk is unauthorized access to project data, source repositories, and release management pipelines, with downstream impacts on corporate CI/CD integrity.

Technical Analysis

Vulnerability Class: Use of Default Password (CWE-1393)

CWE-1393 identifies a class of vulnerabilities where user accounts preserve default passwords after deployment or import. In the context of Tuleap Enterprise Edition, the XML import functionality permits the creation of user accounts at scale. The flaw materializes when those newly-created accounts are provisioned with a default password — either a static value, a predictable derived value, or a blank string — and the system fails to enforce password change upon first login.

Mechanism:

1. XML Import Process: Tuleap supports importing users and their associated metadata via XML that references RFC-compliant LDAP or database schema. During this process, a new user object is created in the underlying user identity store. The import routine is expected to set a strong, random password or require password set-up via an invitation token. In versions 17.0 through 17.5, this routine either fails to generate a credential or generates a predictable default value.

2. Post-Import State: After the import, the user accounts remain in an active state with the default credential. No forced password reset flag is set, and no email invitation is sent. Authentication against these accounts succeeds if an attacker supplies the default password.

3. Attack Surface: The attacker does not need prior access to the Tuleap instance. The vulnerable endpoint is the standard HTTPS login interface, which accepts username and password. The attack is network-based, and the only obstacle is correctly guessing usernames (which may be discoverable through Tuleap's user search or REST API) and supplying the default password.

Why CVSS Score is 7.7 (High):

• Attack Vector: Network (AV:N) — The login interface is exposed on the corporate network.
• Attack Complexity: High (AC:H) — Mitigations like rate limiting, account lockout policies, or strong password complexity may limit successful brute-force attempts. Additionally, the attacker must identify default-password accounts, which may not be present in every instance.
• Privileges Required: None (PR:N) — No prior access is needed.
• User Interaction: None (UI:N) — No victim interaction is required beyond administrative configuration.
• Confidentiality Impact: High (C:H) — Successful authentication grants access to all projects the compromised user is a member of, including code repositories, documents, and administrative data if the imported account holds admin rights.
• Integrity Impact: High (I:H) — The attacker can modify repository contents, issue tracker items, and release artifacts.
• Availability Impact: Low (A:L) — The attacker could disrupt services, but the primary impact is data theft and tampering.

No Specific Technical Details Available: The NVD description does not mention the specific default password format, the XML import field names, or exact endpoint implementations. Therefore, this report describes the exploit mechanism at the vulnerability-class level, avoiding invented code identifiers. Users are advised that actual exploitation may vary slightly depending on installation configuration.

Exploitation Scenarios

Note: No public PoC exists for CVE-2026-19851. The attack chain described below is inferred from the vulnerability class (CWE-1393) and the Tuleap XML import functionality as described in official Tuleap documentation. Specific function names or code paths are not referenced due to a lack of public technical detail.

Step 1: Reconnaissance / Target Identification

The attacker begins by identifying Tuleap Enterprise instances. Standard reconnaissance methods include:

• Shodan or Censys search for HTTP headers or TLS certificates referencing Tuleap.
• Google dorking for the default Tuleap login page (inurl:login.php "Tuleap").
• Querying the Tuleap REST API (/api/v1/users) if it is exposed and allows unauthenticated enumeration of usernames. If the API is not exposed, the attacker can infer usernames from an organization's naming convention (e.g., firstname.lastname) or by brute-forcing usernames via the login page response differences.

Step 2: Triggering the Flaw

Once a target Tuleap instance is found, the attacker attempts to authenticate against the login portal (https://target.tuleap.net/). The attacker will attempt the valid default passwords (commonly tuleap, password, changeme, admin, or an empty string) against candidate usernames.

The login endpoint typically reveals whether a username exists through error message inconsistencies (e.g., "Invalid username or password" vs. "Username does not exist" in older versions), assisting in username enumeration.

Step 3: Payload / Execution Method (Vulnerability-Class Level)

The attacker supplies the crafted HTTP POST request to the authentication endpoint:

POST /login.php HTTP/1.1
Host: target.tuleap.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 42

username=victim.user&password=changeme

If the target account was created via XML import without a forced password rotation, the server validates the changeme password successfully, returning an authentication session or a cookie (tl_session) that establishes the attacker as the victim user.

Step 4: Post-Exploitation Impact

With a valid authenticated session, the attacker can:

• Access project repositories: If the imported user had Git access, the attacker can clone, read, and push malicious code to repositories.
• Read confidential documents: Download and exfiltrate project documentation, release notes, or customer data.
• Manipulate issue tracker: Create, edit, or delete tracker items.
• Escalation potential: If an imported account holds administrative privileges (e.g., a project admin or site admin), the attacker can create new users, modify site configuration, and potentially achieve full server subversion.
• Lateral movement: Using valid credentials, the attacker can pivot to other systems if credentials are reused (though disclosure via Tuleap is limited).

Impact Assessment

CVSS Break-Down

Business Impact

• Data Breach: In organizations using Tuleap for agile development, source code and sprint planning content is considered confidential. A successful compromise of a developer account would expose proprietary code.
• Code Integrity: With push access, an attacker can inject backdoors or supply-chain malware into code repositories that feed CI/CD pipelines.
• Compliance Violation: If the Tuleap instance stores customer personal data within tracker or document systems, the breach may constitute a reportable data breach under GDPR/CCPA.
• Blast Radius: The number of compromised accounts is bounded by how many were created via XML import without forced password rotation. However, in large migrations (e.g., from another ALM tool), this could constitute hundreds of accounts.

Affected Systems

• Tuleap Enterprise Edition versions 17.0, 17.1, 17.2, 17.3, 17.4, 17.5.
• Only instances that used the XML import feature to create users are at risk; instances where all users were provisioned via SSO/LDAP/SCIM and where password-based login is disabled are not exposed to this specific flaw.
• On-premises installations are most at risk, as cloud/SaaS versions may be patched by Tuleap's hosting team; however, no official advisory distinguishes between on-prem vs. cloud.

Detection Guidance

Sigma Rule

The following Sigma rule detects potentially anomalous login activity against Tuleap instances that may indicate default password exploitation.

title: Tuleap Enterprise Default Password Login Attempt
id: 4f7e5f2b-8a1a-4e6e-93b9-1a2b3c4d5e6f
status: experimental
description: Detects multiple failed login attempts followed by a successful login on Tuleap, potentially indicating brute-force of default passwords on XML-imported accounts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19851
author: Valters It Security
date: 2026/03/20
logsource:
    category: application
    product: tuleap
    service: login
detection:
    selection_status:
        event.outcome: 'success'
    selection_user:
        user.name|contains:
            - 'admin'
            - 'test'
            - 'backup'
    selection_body:
        request.body|contains|all:
            - 'password=changeme'
            - 'password=tuleap'
            - 'password=password'
    timeframe: 5m
    condition: selection_status and selection_user and selection_body
level: high
falsepositives:
    - Legitimate users resetting to a weak password
    - Admin testing
tags:
    - attack.t1078
    - attack.initial_access
    - cve.2026-19851

YARA Rule

A YARA rule to detect Tuleap logs or configuration files referencing default credentials on imported accounts.

rule Tuleap_Default_Password_19851
{
    meta:
        author = "Valters It Security"
        description = "Detects log entries or config files containing default Tuleap password patterns"
        cve = "CVE-2026-19851"
        date = "2026-03-20"
    strings:
        $pwd1 = "changeme" ascii wide nocase
        $pwd2 = "password=tuleap" ascii wide nocase
        $pwd3 = "password=admin" ascii wide nocase
        $import = "xml_import" ascii wide nocase
        $user = "user_account" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x00000000
        and 2 of ($pwd*) 
}

Suricata IDS Rule

Network-level detection for login attempts targeting Tuleap with default passwords.

alert http any any -> $TULEAP_SERVERS any (msg:"Tuleap Default Password Login Attempt CVE-2026-19851"; flow:established,to_server; content:"POST"; http_method; content:"/login.php"; http_uri; content:"password=changeme"; http_client_body; fast_pattern:only; content:"username="; http_client_body; classtype:attempted-admin; sid:202619851; rev:1;)

Elastic Detection

EQL rule for Elastic Security detecting the login event pattern.

sequence by host.name with maxspan=5m
  [ any where event.category == "authentication" and process.name == "httpd" and
      event.outcome == "failure" and http.request.body.text : "*password=*" ]
  [ any where event.category == "authentication" and process.name == "httpd" and
      event.outcome == "success" and http.request.body.text : (
          "*password=changeme*", "*password=tuleap*", "*password=admin*"
      )
  ]

Splunk SPL Query

index=web sourcetype=access_combined status=200
| rex field=uri_path "(?<page>/login\.php)"
| rex field=_raw "password=(?<submitted_pwd>\S+)"
| search page="/login.php" AND submitted_pwd IN ("changeme", "tuleap", "password", "admin")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, submitted_pwd, user
| where count > 3
| table _time, src_ip, user, submitted_pwd, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="tuleap,">
  <rule id="198511" level="10">
    <decoded_as>httpd</decoded_as>
    <description>Possible Tuleap default password use (CVE-2026-19851)</description>
    <if_sid>31100</if_sid>
    <match>password=changeme|password=tuleap|password=admin</match>
    <options>no_full_log</options>
    <group>authentication_failures,attack.t1078,</group>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  <rule id="198512" level="12">
    <if_sid>198511</if_sid>
    <match>200</match>
    <description>Successful login after default password attempt</description>
    <group>authentication_success,attack.t1078,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (0/4 confidence)

As of the latest assessment, no vendor patch is available for CVE-2026-19851. Tuleap has not issued a security advisory covering this issue, and no fixed version (e.g., 17.6 or 18.0) has been flagged as resolving the vulnerability. Users must treat all Tuleap Enterprise versions 17.0–17.5 as at-risk.

1) Immediate Mitigations

• Disable password-based login for imported accounts: If your Tuleap instance supports SSO (SAML/OIDC/LDAP), restrict local password logins to administrative break-glass accounts only.
• Force password reset on next login: Immediately after any XML import, run a script that sets a random password and marks the account as “must change password on next login.” While this does not remove the vulnerability’s existence, it neutralizes its exploitability in your instance.
• Enable account lockout: Configure Tuleap’s authentication module to lock accounts after 3-5 failed attempts for 15 minutes. This raises attack complexity for brute-force attempts.
• Network restriction: Use a VPN or IP whitelist to restrict the login interface to trusted network segments.
• Audit existing accounts: Review all accounts created through XML import between the time you upgraded to v17.0 and your current version. Look for accounts with empty passwords, weak password hashes, or that have never been logged into but have active sessions.

2) Patch / Upgrade Steps

• Check for a vendor hotfix: Tuleap typically provides security patches on their official mailing list and forums. Subscribe to security@tuleap.org or monitor https://www.tuleap.org/security.
• Upgrade path: When a patched version (≥17.6 or 18.0) is released, upgrade through the standard Tuleap upgrade process: backup the database, run the upgrade script (/usr/lib/tuleap/bin/upgrade), and clear cache. Do NOT skip intermediate versions if the upgrade notes indicate dependencies.
• Validate password strength post-upgrade: After applying a patch, run a validation script that flags any user with a password matching the known default list and requires a password reset.

3) Long-Term Hardening

• Eliminate password-based accounts: Transition from local password authentication to OAuth/SAML/OpenID Connect tied to your enterprise identity provider. This reduces reliance on Tuleap’s own password storage and eliminates default credential risk.
• Inventory XML imports: Document every XML import; include a checklist item that verifies all imported accounts have either a forced-password-change flag or have been deactivated after import.
• Monitor hashcat/brute-force tools: Add tuning rules for SIEM/SOAR platforms that flag sudden volumes of login failures from single IPs targeting a high number of usernames.
• Include CVE-2026-19851 in vulnerability management scans: Use the CVE ID to tag affected assets in your CMDB and ensure they are subjects of continuous monitoring until patched.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19851 — Official NVD record, includes CVSS v3.1 vector and CWE-1393 classification.
2. Tuleap Security Page: https://www.tuleap.org/security — Vendor advisory page; check for updates on CVE-2026-19851.
3. Tuleap Documentation — XML Import: https://docs.tuleap.org/user-guide/administration/importing-data.html — Official documentation explaining the XML import feature scope referenced in the vulnerability description.
4. MITRE ATT&CK — Valid Accounts (T1078): https://attack.mitre.org/techniques/T1078/ — MITRE technique covering unauthorized use of valid credentials, relevant to exploit scenarios above.
5. CWE-1393 Reference: https://cwe.mitre.org/data/definitions/1393.html — Common Weakness Enumeration definition for Use of Default Password.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence

No known exploit-in-the-wild activity has been reported for CVE-2026-19851.

• CISA KEV: Not listed.
• PoC: None available.
• Threat actor interest: It is likely that automated botnets monitoring for default credential logins (e.g., Mirai variants, SSH/HNAP scanners) might eventually discover the Tuleap login page and attempt default passwords. Organizations running the affected versions with an internet-exposed login page should anticipate scanning within 30 days of disclosure. However, as of the report date, no specific threat actor group has publicly claimed attribution to such scanning.