CVE-2026-40471

Critical

Published: 23 April 2026

Published

23 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

EPSS Score 0.0002 5.1th percentile

Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40471 is a critical-severity CSRF (CWE-352) vulnerability in Osv (inferred from references). Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-23 Session Authenticity good match

prevent

SC-23 requires protection of communications session authenticity, directly mitigating CSRF by preventing forged requests that exploit valid session credentials.

SI-10 Information Input Validation good match

prevent

SI-10 mandates validation of information inputs, enabling anti-CSRF tokens to verify the legitimacy of requests across endpoints.

AC-14 Permitted Actions Without Identification or Authentication partial match

prevent

AC-14 identifies and authorizes actions performable without identification or authentication, reducing abuse of unauthenticated endpoints like user account creation via CSRF.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

T1136.003 Cloud Account Persistence

Adversaries may create a cloud account to maintain access to victim systems.

attack.mitre.org →

Why these techniques?

CSRF vuln in public-facing hackage-server enables remote exploitation (T1190) via external malicious scripts; directly facilitates unauthorized package uploads (T1105) and creation of user accounts (T1136.003).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g.…

creating new user accounts).

Deeper analysisAI

CVE-2026-40471 is a Cross-Site Request Forgery (CSRF) vulnerability in hackage-server, stemming from a lack of CSRF protection across its endpoints and mapped to CWE-352. Published on 2026-04-23, it has a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L), indicating high severity with network accessibility, low attack complexity, no required privileges, user interaction needed, and changed scope impacting confidentiality, integrity, and availability.

Attackers can exploit this vulnerability remotely by hosting malicious scripts on foreign websites that a victim visits while authenticated to hackage-server. These scripts trigger unauthorized requests, potentially abusing the victim's latent credentials to upload packages or perform other administrative actions. Unauthenticated endpoints, such as those for creating new user accounts, can also be abused without credentials.

Mitigation details are available in the advisory at https://osv.dev/vulnerability/HSEC-2026-0002.