CVE-2026-40471
Published: 23 April 2026
Summary
CVE-2026-40471 is a critical-severity CSRF (CWE-352) vulnerability in Osv (inferred from references). Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-40471 is a Cross-Site Request Forgery (CSRF) vulnerability in hackage-server, stemming from a lack of CSRF protection across its endpoints and mapped to CWE-352. Published on 2026-04-23, it has a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L), indicating high severity with network accessibility, low attack complexity, no required privileges, user interaction needed, and changed scope impacting confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely by hosting malicious scripts on foreign websites that a victim visits while authenticated to hackage-server. These scripts trigger unauthorized requests, potentially abusing the victim's latent credentials to upload packages or perform other administrative actions. Unauthenticated endpoints, such as those for creating new user accounts, can also be abused without credentials.
Mitigation details are available in the advisory at https://osv.dev/vulnerability/HSEC-2026-0002.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25234
Vulnerability details
hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g.…
more
creating new user accounts).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vuln in public-facing hackage-server enables remote exploitation (T1190) via external malicious scripts; directly facilitates unauthorized package uploads (T1105) and creation of user accounts (T1136.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires protection of communications session authenticity, directly mitigating CSRF by preventing forged requests that exploit valid session credentials.
SI-10 mandates validation of information inputs, enabling anti-CSRF tokens to verify the legitimacy of requests across endpoints.
AC-14 identifies and authorizes actions performable without identification or authentication, reducing abuse of unauthenticated endpoints like user account creation via CSRF.