CVE-2026-40471criticalCWE-352

Hackage CSRF vulnerability

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.6epss 0.1%

probabilidad de explotación

0.1%top 97% de las CVE

explotación observada

noninguna fuente lo reporta

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Productos afectados

hackage-server

Referencias

https://osv.dev/vulnerability/HSEC-2026-0002