What is CVE-2026-40471?

CVE-2026-40471 is a critical-severity vulnerability, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.6/10. Published 2026-04-23.

How severe is CVE-2026-40471?

Critical severity. CVSS v3 base score is 9.6 out of 10.

CVE-2026-40471

CVE-2026-40471

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrat…

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.000 (5.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L.

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

osv.dev/vulnerability/HSEC-2026-0002

Frequently asked questions

What is CVE-2026-40471?: CVE-2026-40471 is a critical-severity vulnerability, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.6/10. Published 2026-04-23.
How severe is CVE-2026-40471?: Critical severity. CVSS v3 base score is 9.6 out of 10.