Posit is now a CVE Numbering Authority

On Tuesday, 27 October 2026, Posit became a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA). The CVE Program has authorized us to assign CVE IDs and publish CVE Records for vulnerabilities in the software we maintain, with MITRE as our Top-Level Root. We join more than 500 CNAs in over 40 countries, including Microsoft, Google, and Apple.

If your team scans Posit Workbench, Posit Connect, or our open source tools for vulnerabilities, the CVE Records you see for that software will now come from us, the team that builds and fixes it.

What is a CVE Numbering Authority (CNA)?

A CVE Numbering Authority (CNA) is an organization the CVE Program authorizes to assign CVE IDs and publish CVE Records within a defined scope. The CVE Program catalogs publicly disclosed cybersecurity vulnerabilities, with one CVE Record for each vulnerability. Vulnerability scanners read those records, and security teams use the results to decide what to patch first.

Until now, we asked other CNAs, such as MITRE and GitHub, to assign CVE IDs for our products. As a CNA, we get the first opportunity to assign IDs for vulnerabilities in our scope, and we write the records ourselves.

What changes for security teams that scan Posit software

As a CNA, we perform the following:

• Include the CVE ID in the first advisory. We reserve an ID before disclosure, so our first public advisory includes it. You can match the advisory to your scanner findings as soon as we publish.
• Publish version and severity data. Our CVE Records list the affected and fixed versions and a Common Vulnerability Scoring System (CVSS) v4.0 severity score.
• Publish security advisories and records from one source. We publish advisories at trust.posit.co and CVE Records in the CVE List at cve.org.

“Many of our customers work in regulated industries and run their vulnerability programs on CVE data,” said Rick Johnson, VP of Information Technology & Security at Posit. “As a CNA, we publish that record ourselves, alongside our advisory, with the affected and fixed versions their teams need.”

Which Posit products the CNA authorization covers

The authorization covers all Posit products:

• Commercial software: Posit Workbench, Posit Connect, and Posit Package Manager.
• Hosted services: Posit Connect Cloud, Posit Cloud, and shinyapps.io. For hosted services, we assign a CVE ID when you need to take action or need the record to assess your exposure.
• Open source software: RStudio, Positron, Quarto, Shiny, and the R and Python packages we maintain.

We assign CVE IDs only for software we maintain. The maintainers of third-party packages that Posit Package Manager distributes handle vulnerabilities in those packages. Other CNAs handle vulnerabilities in the software they cover.

How to report a vulnerability to Posit

If you find a vulnerability in Posit software, email security@posit.co. Use the PGP key on our Product Security page for sensitive details. For our open source projects, you can also use GitHub private vulnerability reporting. Either way, you reach the team that fixes the issue and assigns the CVE ID.

Under our Vulnerability Disclosure Policy, we commit to:

• Acknowledge reports within 3 business days
• Complete an initial assessment within 10 business days
• Update the reporter at least every 30 days
• Share the CVE ID within 2 business days of assignment
• Target coordinated disclosure within 90 days

We don't run a bug bounty program.

Frequently asked questions

Where to find Posit security advisories and CVE Records

Add trust.posit.co/updates to the sources your security team monitors. On cve.org, new CVE Records for our software will list Posit as the CNA. If you have questions about how we handle a specific product, email security@posit.co.