Description

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T22:17:18.333Z",
  "pubdate": "2026-09-04T22:17:18.333Z",
  "executiveSummary": "Ignition 8.1.53 and earlier contains a security misconfiguration regarding the 'Create Project Role(s)' gateway setting. In default configurations, this parameter was left blank, effectively granting unauthorized authenticated users the capability to programmatically generate new projects. This vulnerability stems from improper access control mechanisms that failed to restrict project creation privileges to authorized administrative roles.\nThe vulnerability allows an authenticated attacker, provided they have the ability to execute gateway scripts, to bypass intended administrative workflows and create arbitrary projects within the Ignition platform. This capability poses significant security risks, including the potential for unauthorized code execution, persistence mechanisms through malicious script execution, and the modification of HMI/SCADA configurations. The issue is remediated in Ignition 8.1.54, which restricts project creation exclusively to authorized Designer sessions, deprecating the reliance on the vulnerable role configuration setting. Organizations utilizing affected versions are at risk of privilege escalation if they have not strictly hardened user permissions regarding gateway scripting capabilities.",
  "technicalDetails": "The vulnerability is localized within the Ignition Gateway’s project management framework. Specifically, the 'Create Project Role(s)' configuration setting—intended to restrict project creation to specific user roles—shipped with an empty value in versions 8.1.53 and earlier. Under this default state, the system failed to enforce valid role-based access control (RBAC) checks during the project creation process. Consequently, any authenticated user possessing the ability to invoke gateway-side scripting functions could perform actions reserved for higher-privileged administrative users.\nThe attack flow involves an authenticated user interacting with the Ignition Gateway API or utilizing exposed scripting interfaces (such as system.project.create) to initiate a project creation request. Because the validation logic for the 'Create Project Role(s)' setting was improperly initialized as a null or empty state, the server-side authorization check defaulted to a permissive state rather than a secure-by-default 'deny all' stance. This allows the attacker to execute privileged administrative operations without holding the requisite administrative credentials.\nThe vulnerable component is the gateway’s core project management module. Exploitation requires that the attacker has authenticated access to the system and is capable of executing scripts within the gateway environment. This effectively limits the attack surface to users who already hold, or have compromised, an account with sufficient permissions to execute gateway-level scripts. However, once the attacker has initiated the project creation, they gain full control over the newly created project's configuration, which includes the ability to embed malicious scripts, configure gateway event scripts, or modify project tags. This post-exploitation behavior enables a persistent vector for code execution, as these malicious scripts can be scheduled to run with the full privileges of the Ignition Gateway service. Ignition 8.1.54 effectively eliminates this vulnerability by decoupling project creation from the legacy, role-based configuration setting and hardcoding the restriction to authorized Designer sessions only, thereby ensuring that even authenticated users cannot generate projects outside of the intended, authenticated design environment. Systems running the 8.3 series are fundamentally architected to avoid this specific authorization flaw."
}