{"id":"CVE-2026-121578","kind":"vulnerability","aliases":["CVE-2026-121578"],"related":[],"title":"Tactical RMM: stored XSS in tools database runs script in viewers' browsers","description":"Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.","summary":"Tactical RMM does not validate or encode certain fields, so HTML and JavaScript can be saved to the tools database. That code runs in the browser of any user who views the affected objects, enabling account takeover or code execution in the browser.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["msp","runtime","self-hosted","tactical-rmm"],"not_affected_if":["not-running-tactical-rmm"],"how_to_check":"- Confirm whether you run Tactical RMM and which version is installed\n- Review the tools database for stored objects containing HTML or script tags","fix":null,"status":"open","published_at":"2026-11-03T16:17:29+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","triaged_at":"2026-11-03T16:24:32+00:00","updated_at":"2026-11-03T16:24:32+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-03T16:24:32Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Tactical RMM: stored XSS in tools database runs script in viewers' browsers","impact":"high","summary":"Tactical RMM does not validate or encode certain fields, so HTML and JavaScript can be saved to the tools database. That code runs in the browser of any user who views the affected objects, enabling account takeover or code execution in the browser.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["tactical-rmm","self-hosted","msp"],"confidence":0.5,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in users' browsers, enabling account takeover or code execution","analyst_note":"Find the affected and fixed Tactical RMM versions and the patch commit linked from the NVD entry (github.com patch link).","how_to_check":"- Confirm whether you run Tactical RMM and which version is installed\n- Review the tools database for stored objects containing HTML or script tags\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["not-running-tactical-rmm"],"who_is_affected":"Teams that self-host Tactical RMM and let users create or view tools or other stored content in its web interface are exposed. Sources do not state which versions are affected or any non-default setting required. Deployments that do not run Tactical RMM can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":4122,"output_tokens":511,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121578':15A,18A '-2026':14A,17A 'account':62B,116C 'affect':59B 'browser':12A,52B,69B,103C 'caus':77C 'certain':34B 'code':48B,65B,119C 'contain':72C,110C 'content':109C 'cve':13A,16A 'databas':7A,46B,96C 'enabl':61B,88C 'encod':33B,83C 'execut':66B,100C,120C 'field':35B,87C 'host':23B 'html':37B 'html/javascript':89C 'improp':79C 'infect':112C 'input':81C 'javascript':39B 'lead':114C 'msp':19B 'object':60B,113C 'output':84C 'rmm':2A,26B,28B,71C 'run':8A,49B 'runtim':20B 'save':42B 'script':9A 'self':22B 'self-host':21B 'store':3A,74C,92C 'tactic':1A,25B,27B,70C 'tactical-rmm':24B 'takeov':63B,117C 'tool':6A,45B,95C 'user':55B,105C 'valid':31B,80C 'various':86C 'view':57B,108C 'viewer':11A 'vulner':76C 'xss':4A,75C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Tactical RMM and let users create or view tools or other stored content in its web interface are exposed. Sources do not state which versions are affected or any non-default setting required. Deployments that do not run Tactical RMM can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["msp","runtime","selfhosted","tacticalrmm","unknown"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121578","severity":null,"published_at":"2026-11-03T16:17:29+00:00","modified_at":"2026-11-03T16:17:29+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","fetched_at":"2026-11-03T16:21:45+00:00","note":null}],"documents":[{"id":58868,"url":"https://github.com/amidaware/tacticalrmm-web/commit/ba5363ea99cf776511e5c828b6d744e4d0bddd08","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}