CVE-2026-40471

critical · 9.6

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

9.6

CVSS

0.1%

EPSS (exploit prob.)

3rd

EPSS percentile

2026-04-23

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Weaknesses

CWE-352

References

https://osv.dev/vulnerability/HSEC-2026-0002

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-40471