CVE-2023-38122 is a high severity (CVSS 7.2) weakness in Ignition: the web server lacks suitable Content Security Policy headers, which ZDI says an attacker can combine with other flaws to run code as SYSTEM. Upgrade Ignition to 8.1.26 or later and check the vendor advisory.
What's affected
The product is Inductive Automation Ignition. The flaw is in the web server configuration, where the lack of appropriate Content Security Policy headers leaves a permissive cross-domain policy. ZDI describes it as usable only in conjunction with other vulnerabilities, and says authentication is required but that the existing authentication mechanism can be bypassed. The record is dated 2024-05-03 and the vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
NVD and ZDI agree on the score of 7.2, High. This is one of several Ignition issues from the same contest, and the related CVE-2023-38123 describes an authentication bypass.
Inductive Automation's own blog post on Pwn2Own Miami 2023 says the security update for the remote code execution issue is included in Ignition 8.1.26, scheduled for stable release on 21 March 2023. It does not map each CVE to a specific version. The NVD record lists Ignition without a version range, and ZDI says only that the vendor has issued an update. Treat 8.1.26 as the minimum to look for, and confirm against Inductive Automation's security advisories for the exact fix of this CVE.
Weakness class: CWE-942.
How to check if you're exposed
Check the Ignition version in the Gateway web page and compare it with 8.1.26. You can also look at the response headers of the Gateway web server from a management workstation and confirm whether a Content Security Policy header is present after your upgrade.
curl -sI https://your-gateway.example:8043/ | grep -i content-security-policy
Replace the host and port with your own Gateway address. A missing header on a patched version is worth raising with the vendor.
What to do now
- Find every Ignition Gateway and note its version.
- Upgrade to 8.1.26 or later and read the vendor advisory for the fixed version of this specific issue.
- Limit which networks can reach the Gateway web ports.
- Review and tighten cross-origin settings for any custom web content you serve from the Gateway.
- Review administrator accounts and remove any you do not recognise.
Why it matters
A Content Security Policy tells a browser which sources a page may load script and frames from. Without one, or with a policy that trusts too much, a hostile page has more room to interact with the application. On its own this issue is a stepping stone. ZDI says it is meant to be combined with others.
That framing matters for triage. Security teams often rank a flaw that cannot work alone below one that can. In a chain, though, the weakest link decides how far an attacker gets. When a vendor ships several fixes at once, apply the whole release rather than selecting by score. The CVE is not on the CISA Known Exploited Vulnerabilities list.
A permissive cross-domain policy means a web server tells browsers that pages from other origins may talk to it, often with credentials. When the list of trusted origins is too wide, or missing, a page on an untrusted site can make requests that the browser sends with the victim's session. The fix is to name the exact origins that need access and to send restrictive headers by default.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Can this be used alone?
ZDI says it is used in conjunction with other vulnerabilities, so treat it as part of a chain and patch the full set.
What is the minimum version to look for?
The vendor's blog points to 8.1.26 for the remote code execution fix. Confirm this CVE's fixed version in the Inductive Automation advisory.
Sources
Last reviewed: 19 October 2026.
