Ignition Gateway flaw allows unauthorized project creation
A default-configuration flaw in Inductive Automation Ignition lets any authenticated user create projects on affected 8.1.x versions.
CISA published an advisory for CVE-2026-77393 affecting Inductive Automation Ignition versions 8.1.53 and earlier. The issue stems from the Gateway's "Create Project Role(s)" setting shipping blank by default, which meant no specific role was enforced and any authenticated user able to execute gateway scripts could create projects. Inductive Automation characterizes this as a default-value configuration issue rather than a flaw in the access control mechanism itself, since the control correctly enforces whatever role is specified—the problem is that no role was specified out of the box. The 8.3 series is not affected, and version 8.1.54 resolves the issue by restricting project creation to Designer sessions and no longer relying on the vulnerable setting.
The vulnerability affects deployments across Critical Manufacturing, Energy, and Information Technology sectors worldwide, with Inductive Automation headquartered in the United States. No known public exploitation has been reported to CISA at this time. Remediation is straightforward: upgrade to 8.1.54 or later (or the latest 8.3 release), or for organizations that must remain on earlier 8.1 versions, manually populate the "Create Project Role(s)" setting to match the Designer Role, which restores proper access restriction. CISA's standard ICS mitigation guidance applies—minimizing network exposure, isolating control system networks behind firewalls, and using secure remote access methods such as VPNs.
Mentioned in this report
Detection guidance
Ignition Gateway Unauthorized Project Creation via Script Execution
Detects authenticated users executing gateway scripts that create projects when the Create Project Role setting is not properly configured, bypassing access controls. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ignition Gateway Unauthorized Project Creation via Script Execution
description: Detects project creation requests originating from authenticated Ignition
Gateway script execution contexts where the Create Project Role setting is blank
or misconfigured, allowing unauthorized project instantiation. Focuses on the gateway
script execution pathway combined with project creation operations.
tags:
- attack.initial-access
- attack.t1190
logsource:
product: ignition
category: gateway_audit
detection:
selection_project_creation:
event_type: project_created
source: gateway_script_execution
filter_designer_role:
user_role: Designer
condition: selection_project_creation and not filter_designer_role
falsepositives:
- Legitimate administrative users creating projects via gateway scripts
- Authorized automation workflows that dynamically provision projects
level: high
id: 21c0bc4c-aa38-51f2-9185-c7d3539ba0d1
status: experimental
author: Vorant
Ignition Gateway Access Control Bypass via Missing Role Configuration
Detects project creation attempts by non-Designer authenticated users when the Create Project Role setting is blank or unconfigured, indicating default-value misconfiguration vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ignition Gateway Access Control Bypass via Missing Role Configuration
description: Detects authenticated users creating Ignition projects when the Create
Project Role security setting is empty or not explicitly configured, bypassing intended
role-based access controls. This rule identifies the configuration weakness rather
than a specific exploit technique.
tags:
- attack.persistence
- attack.t1078.001
logsource:
product: ignition
category: gateway_audit
detection:
selection_auth_project_create:
event_type: project_created
create_project_role_setting:
- ''
- null
filter_designer_session:
session_type: Designer
condition: selection_auth_project_create and not filter_designer_session
falsepositives:
- Organizations deliberately removing role restrictions for internal development environments
- Test deployments with intentionally permissive configurations
level: medium
id: dfcecf7e-0411-5481-98e0-3da98dc5038d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-06
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free