IPT

Download

ipt@lists.gbif.org

October 2026

2 participants
1 discussions

[Urgent] Security: IPT versions before 3.3.4 are being actively exploited, please upgrade
by Mikhail Podolskiy 30 Oct '26

30 Oct '26

Dear all, If your IPT runs a version older than 3.3.4, please upgrade immediately. These versions contain a critical vulnerability (CVE-2026-71878 [1]). A public exploit exists, and we have received several reports of installations being compromised. The latest release is 3.3.7 [2]. If you don't manage an IPT yourself but know who does at your institution, please forward this message to them. What the vulnerability allows Before 3.3.4, the setup wizard steps can still be reached without logging in after installation is complete [3]. An attacker can use this to: - switch the IPT to a new, empty data directory, so your datasets disappear from the public site; - create their own administrator account; - use that account to upload crafted files and possibly run code on the server. How to check your installation - Administrator accounts you don't recognise. - A data directory under /tmp or another unexpected path. - An IPT that suddenly shows no datasets, or logs that stop being written in your usual data directory. - Look for requests to /setup pages in your access logs after the IPT was installed. Recommendations - Upgrade to the latest version, 3.3.7. - As an extra layer, block /setup* on your reverse proxy once the IPT is installed. - If you find signs of compromise: reinstall the IPT on a clean server or container, restore the data directory from a backup taken before the attack, reset the passwords of all user accounts, and rotate the database credentials used by SQL sources. Users who reused their IPT password elsewhere should change it there as well. If you have questions or think your installation was affected, please contact us at helpdesk(a)gbif.org. Best regards, Mikhail [cid210579*89c778a6-557f-4650-b711-2f533b62a625]<https://gbif.link/25> Mikhail Podolskiy Developer GBIF: the Global Biodiversity Information Facility Universitetsparken 15 | DK-2100 Copenhagen | DENMARK GBIF.org<https://www.gbif.org/> | Mastodon<https://biodiversity.social/@gbif> | Bluesky<https://bsky.app/profile/gbif.org> | LinkedIn<https://www.linkedin.com/company/gbif/> | Facebook<https://www.facebook.com/gbifnews/> ----- [1] https://nvd.nist.gov/vuln/detail/cve-2026-71878 [2] https://ipt.gbif.org/manual/en/ipt/latest/releases [3] https://github.com/gbif/ipt/issues/3115

2 1