VulnerabilityAwaiting Analysis

CVE-2026-40471

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints.

CRITICAL 9.6EPSS 0.14%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

CVSS 3.1: 9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
EPSS: 0.14% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-352
Source: 74b3a70d-cca6-4d34-9789-e83b222ae3be

References

https://osv.dev/vulnerability/HSEC-2026-0002

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.