CVE-2026-40471 — Hackage CSRF vulnerability

CVE-2026-40471

Hackage CSRF vulnerability PUBLISHED

Description (CNA)

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 0.1 before *

CWE

CWE-352

References

https://osv.dev/vulnerability/HSEC-2026-0002

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.