CVE-2026-40471: Hackage CSRF vulnerability

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-23 · updated 2026-06-17
Weakness: CWE-352

Description

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

References

https://osv.dev/vulnerability/HSEC-2026-0002

Get alerted when CVE-2026-40471 or the next vulnerability affects your stack