CVE-2026-40960
Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-40960 is a high-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40960 is a vulnerability in Luanti 5 versions prior to 5.15.2 that sometimes allows unintended access to an insecure environment. Specifically, if at least one mod is listed in secure.trusted_mods or secure.http_mods, a crafted mod can intercept requests for the insecure environment or HTTP API and gain access to it. The issue is classified under CWE-670 (Always-Incorrect Control Flow Implementation) with a CVSS v3.1 base score of 8.1 (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
An attacker with local access can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. By crafting a malicious mod that leverages the presence of trusted mods in the specified secure lists, the attacker can intercept and access the insecure environment or HTTP API, potentially leading to high-impact confidentiality, integrity, and availability violations in a changed scope.
Mitigation involves upgrading to Luanti 5.15.2 or later, as detailed in the GitHub security advisory (GHSA-22c4-238c-m5j4) and the associated fix commits (0faf529bc4b89e70a275ed1162047815118f2413 and 827fd4cf7f989482b2dad381fa4afd642ea73e8c), which address the mod interception mechanism.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23151
Vulnerability Data
Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods or secure.http_mods, then a crafted mod can intercept the request for the insecure environment or HTTP API, and also…
more
receive access to it.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V9.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages directly exercises control-flow paths and reveals mismatches between implemented and intended behavior.
Requiring a documented development process and supporting tools reduces the chance that incorrect control-flow logic is introduced in the first place.
Flaw identification and remediation processes can locate and correct control-flow errors once they manifest as incorrect runtime behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent incorrect control-flow implementations via reviews, testing, and static analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle processes can catch incorrect control-flow logic during design and code review.
Secure coding standards and reviews directly target flawed control-flow implementations.
Security testing in development and acceptance can detect paths that deviate from intended logic.
Change-management gates may prevent deployment of flawed logic but do not address the coding defect itself.