CVE-2026-40471

9.6 criticalEPSS 0.1%

Critical (9.6). EPSS 0.1% chance of exploitation in the next 30 days.

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2026-04-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://osv.dev/vulnerability/HSEC-2026-0002

Check your stack JSON