[Urgent] Security: IPT versions before 3.3.4 are being actively exploited, please upgrade
Dear all, If your IPT runs a version older than 3.3.4, please upgrade immediately. These versions contain a critical vulnerability (CVE-2026-71878 [1]). A public exploit exists, and we have received several reports of installations being compromised. The latest release is 3.3.7 [2]. If you don't manage an IPT yourself but know who does at your institution, please forward this message to them. What the vulnerability allows Before 3.3.4, the setup wizard steps can still be reached without logging in after installation is complete [3]. An attacker can use this to: - switch the IPT to a new, empty data directory, so your datasets disappear from the public site; - create their own administrator account; - use that account to upload crafted files and possibly run code on the server. How to check your installation - Administrator accounts you don't recognise. - A data directory under /tmp or another unexpected path. - An IPT that suddenly shows no datasets, or logs that stop being written in your usual data directory. - Look for requests to /setup pages in your access logs after the IPT was installed. Recommendations - Upgrade to the latest version, 3.3.7. - As an extra layer, block /setup* on your reverse proxy once the IPT is installed. - If you find signs of compromise: reinstall the IPT on a clean server or container, restore the data directory from a backup taken before the attack, reset the passwords of all user accounts, and rotate the database credentials used by SQL sources. Users who reused their IPT password elsewhere should change it there as well. If you have questions or think your installation was affected, please contact us at helpdesk@gbif.org. Best regards, Mikhail [cid210579*89c778a6-557f-4650-b711-2f533b62a625]<https://gbif.link/25> Mikhail Podolskiy Developer GBIF: the Global Biodiversity Information Facility Universitetsparken 15 | DK-2100 Copenhagen | DENMARK GBIF.org<https://www.gbif.org/> | Mastodon<https://biodiversity.social/@gbif> | Bluesky<https://bsky.app/profile/gbif.org> | LinkedIn<https://www.linkedin.com/company/gbif/> | Facebook<https://www.facebook.com/gbifnews/> ----- [1] https://nvd.nist.gov/vuln/detail/cve-2026-71878 [2] https://ipt.gbif.org/manual/en/ipt/latest/releases [3] https://github.com/gbif/ipt/issues/3115
Dear Mikhail, I upgraded the IPT to 3.3.7 (I also had to upgrade to Tomcat10 and OpenJDK-21), but can't log as an admin to the new version. It still seems that the password is correctly recognized (if i provide a wrong one I get an error message, while nothing appear with the good one), but I don't have a session with the correct one. Best regards, Franck ________________________________ From: Mikhail Podolskiy via IPT <ipt@lists.gbif.org> Sent: Friday, October 30, 2026 10:57 To: IPT Mailing List <ipt@lists.gbif.org> Cc: helpdesk <helpdesk@gbif.org> Subject: [IPT] [Urgent] Security: IPT versions before 3.3.4 are being actively exploited, please upgrade Dear all, If your IPT runs a version older than 3.3.4, please upgrade immediately. These versions contain a critical vulnerability (CVE-2026-71878 [1]). A public exploit exists, and we have received several reports of installations being compromised. The latest release is 3.3.7 [2]. If you don't manage an IPT yourself but know who does at your institution, please forward this message to them. What the vulnerability allows Before 3.3.4, the setup wizard steps can still be reached without logging in after installation is complete [3]. An attacker can use this to: - switch the IPT to a new, empty data directory, so your datasets disappear from the public site; - create their own administrator account; - use that account to upload crafted files and possibly run code on the server. How to check your installation - Administrator accounts you don't recognise. - A data directory under /tmp or another unexpected path. - An IPT that suddenly shows no datasets, or logs that stop being written in your usual data directory. - Look for requests to /setup pages in your access logs after the IPT was installed. Recommendations - Upgrade to the latest version, 3.3.7. - As an extra layer, block /setup* on your reverse proxy once the IPT is installed. - If you find signs of compromise: reinstall the IPT on a clean server or container, restore the data directory from a backup taken before the attack, reset the passwords of all user accounts, and rotate the database credentials used by SQL sources. Users who reused their IPT password elsewhere should change it there as well. If you have questions or think your installation was affected, please contact us at helpdesk@gbif.org. Best regards, Mikhail [cid210579*89c778a6-557f-4650-b711-2f533b62a625]<https://gbif.link/25> Mikhail Podolskiy Developer GBIF: the Global Biodiversity Information Facility Universitetsparken 15 | DK-2100 Copenhagen | DENMARK GBIF.org<https://www.gbif.org/> | Mastodon<https://biodiversity.social/@gbif> | Bluesky<https://bsky.app/profile/gbif.org> | LinkedIn<https://www.linkedin.com/company/gbif/> | Facebook<https://www.facebook.com/gbifnews/> ----- [1] https://nvd.nist.gov/vuln/detail/cve-2026-71878 [2] https://ipt.gbif.org/manual/en/ipt/latest/releases [3] https://github.com/gbif/ipt/issues/3115
participants (2)
-
Franck Theeten -
Mikhail Podolskiy