Paper/Archive/CVE-2026-40471

CVE-2026-40471

redhat-cnalr — Hackage CSRF vulnerability

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 3.1.031 × 200.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

Affected

ProductAffectedFixed inSource

hackage-server0.1–CNA

Scores by source

redhat-cnalr (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refosv.dev/vulnerability/HSEC-2026-0002