Ignition 8.1.53 ships blank project-creation role, CISA flags CVE-2026-77393
Any authenticated user who can execute gateway scripts can create projects, the default setting requires no role at all.
TL;DR
CISA disclosed CVE-2026-77393 in Inductive Automation Ignition 8.1.53 and earlier: the "Create Project Role(s)" setting shipped blank, so any authenticated user who can execute gateway scripts can create projects. The flaw is a default-configuration issue, not a broken access control, populate the setting and the vulnerability closes. Inductive Automation recommends upgrading to 8.1.54, which restricts project creation to Designer sessions and drops reliance on the setting entirely. The 8.3 series is unaffected. CVSS 3.1: 8.8. Critical manufacturing and energy environments are the primary concern.
The vulnerability is what it sounds like: Ignition 8.1.53 and earlier ships with the Gateway's "Create Project Role(s)" field blank. That means the platform doesn't require any role to create a project. Any authenticated user who can execute gateway scripts (not just an administrator) can spin up a new project. The access control itself works as designed; the problem is that the default design says "no role required."
Inductive Automation isn't calling this a code flaw. The advisory frames it as a default-value configuration issue, and the fix logic supports that: populate the field with your Designer role and the hole closes. No patch to the access-control mechanism, no re-architecture. Just a shipped default that nobody should have shipped.
The 8.1.54 release sidesteps the setting entirely by restricting project creation to Designer sessions. Users on 8.1.x who can't upgrade immediately can manually configure the "Create Project Role(s)" field in Gateway General Security Settings to match their Designer role. The 8.3 series was never affected.
Christopher Lusk of North Echo Security Research reported the vulnerability to Inductive Automation. Elhussain Fathy (0xSphinx) independently reported it and confirmed the fix. CISA's advisory notes no known public exploitation targeting this vulnerability at this time.
What the practitioner does Monday
Check the "Create Project Role(s)" setting in your Ignition Gateway. If it's blank and you're on 8.1.53 or earlier, populate it. That's a configuration change, not a code deployment, no gateway restart required. Then schedule the upgrade to 8.1.54. The operational risk isn't theoretical: in OT environments where Ignition manages SCADA and HMI functions, an unauthorized project means an attacker who's already authenticated can execute scripts in the context of the Ignition Gateway, with whatever OS-level privileges the service account carries. If you haven't hardened the service account per the Ignition Security Hardening Guide, that's the multiplier.
Published ·Deep Fathom