CVE-2026-40471criticalCWE-352

Hackage CSRF vulnerability

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.6epss 0.1%

probabilidade de exploração

0.1%top 97% das CVEs

exploração observada

nãonenhuma fonte reporta

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Produtos afetados

hackage-server

Referências

https://osv.dev/vulnerability/HSEC-2026-0002