A Blank Field Is Not a Permission List: Ignition's Default Gives Project Creation to Any Logged-In User

The short version//

CISA published ICSA-26-246-06 on Sep 3 — one of a batch of ten ICS advisories that day, and the one in it that homelabbers should actually act on. Inductive Automation Ignition versions 8.1.53 and earlier ship with the Gateway "Create Project Role(s)" setting blank. In most permission systems, an empty role list means "nobody can do this." In Ignition, it means "no restriction at all" — so any authenticated user who can execute gateway scripts could create a new project.

That's CVE-2026-77393: CVSS v3.1 8.8 (High), CWE-276 (Incorrect Default Permissions). Fixed in 8.1.54, which restricts project creation to Designer sessions and stops relying on the setting entirely. The 8.3 series is not affected. No known public exploitation as of publication, and it's not on KEV yet — but "incorrect default" means a stock install has been exposed since day one.

Why a new project is basically root//

For non-OT people: Ignition is the SCADA/HMI platform that sits between your IT network and whatever you're controlling — CNC mills, homebrew rigs, small production lines, lab dashboards. The Gateway is the brain; a project is how work gets organized on it. And a project isn't paperwork. A newly created project can carry:

• Tag providers (the variables that read/write your devices)
• Database and device connections — with their credentials, sitting in the gateway's config
• Gateway-scoped Jython (Python) scripts, including startup and event scripts that run as the Ignition service account when the gateway boots

So "create project" is the wrong name for the permission. The real capability is: write code that runs on your OT demarcation point, has device credentials in reach, and survives reboots. That's privilege escalation plus persistence in one click — which is exactly why CISA rates it 8.8 with high impact across confidentiality, integrity, and availability.

The advisory carries the condition that matters for scoping: exploitation requires a user who "can execute gateway scripts." Not every operator login qualifies — but on an Ignition box where scripting access was granted liberally (it's often how people get things done in the first place), "any authenticated user" is close enough to scary.

The reporting, for the record//

• Christopher Lusk of North Echo Security Research reported it to Inductive Automation.
• Elhussain Fathy (0xSphinx) independently reported the same flaw and confirmed the fix.
• Two researchers finding the same blank field is its own indictment — this default has been sitting there a while.

What you should do tonight//

1. Check the setting first — it takes five minutes. In the Gateway web interface, go to Config > Security > General (the Gateway General Security Settings page) and look at "Create Project Role(s)". If it's empty on an 8.1.x gateway, you were exposed by default. Populate it with only your engineering/admin roles — that alone closes the hole even before you patch.
2. Upgrade to 8.1.54 or later when you can schedule a maintenance window. 8.1.54 stops trusting the setting entirely (project creation is restricted to Designer sessions). If you're on the 8.3 series, you're unaffected — verify your version string and move on.
3. Audit who has Designer/scripting access. The advisory's condition is "can execute gateway scripts" — strip that from operator and read-only accounts, ideally enforced through your IdP rather than local accounts.
4. Hunt for projects you don't recognize. A project created by an account outside your short engineering allowlist is the tell. Security Arsenal's write-up has detection queries (Sigma, KQL) and a host check for the Ignition Java process spawning shells — the classic post-exploitation shape of gateway scripts going to town.
5. Keep gateways off general user VLANs. Default web ports are 8088/8043; restrict them to engineering workstations and jump hosts so "any authenticated user" means any carefully chosen authenticated user.

CISA shipped ten ICS advisories on Sep 3 and this is the one with a five-minute action item instead of a firmware project — which is exactly why it's worth more than its score suggests. If you want the "what does an OT advisory actually mean for my closet server" treatment, our Siemens S7 joint-advisory post walks through the same genre with a bigger cast of agencies.