What’s Vulnerable › Vulnerabilities

CVE-2018-1000843

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-12-20 · updated 2026-06-17
• Weakness: CWE-352

Description

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such as task name, id, parameter, etc. will be leaked to unauthorized users. This attack appear to be exploitable via The victim must visit a specially crafted webpage from the network where their Luigi server is accessible.. This vulnerability appears to have been fixed in 2.8.0 and later.

Affected products

• Spotify Luigi: before 2.8.0 — fixed in 2.8.0

How to fix

Upgrade to a fixed version: Spotify Luigi 2.8.0. Check the vendor advisory for mitigations.

References

• https://github.com/spotify/luigi/blob/2.7.9/luigi/server.py#L67
• https://github.com/spotify/luigi/pull/1870
• https://groups.google.com/forum/#%21topic/luigi-user/ZgfRTpBsVUY
• https://github.com/spotify/luigi/blob/2.7.9/luigi/server.py#L67
• https://github.com/spotify/luigi/pull/1870
• https://groups.google.com/forum/#%21topic/luigi-user/ZgfRTpBsVUY

Get alerted when CVE-2018-1000843 or the next vulnerability affects your stack