CVE-2026-40471
Hackage CSRF vulnerability
Published Mar 28, 2026 · updated Jun 17, 2026
# Hackage CSRF vulnerability * Vulnerable File: (example) * Impact: can forge requests through XSS hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts). To fix the issue, a new CSRF middleware checks all requests. Requests using HTTP methods other than , and are subject to a check of the [ header][sec-fetch-site], which is [widely supported by modern browsers][caniuse-sec-fetch-site]. Cross-site requests are . Certain approved and expected non-browser user agents (e.g. ) are exempted from the check, as are requests using token authentication ( ). The fix has been [committed][commit] and deployed on . ## Acknowledgements - **Joshua Rogers** (https://joshua.hu/) of AISLE (https://aisle.com/) reported the issue to the Haskell Security Response Team. - **Spenser Janssen** implemented the fix, and **Fraser Tweedale** reviewed it. - **Gershom Bazerman** merged the fix and deployed it to . [sec-fetch-site]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Fetch-Site [caniuse-sec-fetch-site]: https://caniuse.com/?search=sec-fetch-site [commit]: https://github.com/haskell/hackage-server/commit/2de3ae45082f8f3f29a41f6aff620d09d0e74058
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 28, 2026 · OSV.dev
Detected
# Hackage CSRF vulnerability * Vulnerable File: (example) * Impact: can forge requests through XSS hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused
Apr 14, 2026 · OSV.dev
Updated
# Hackage CSRF vulnerability * Vulnerable File: (example) * Impact: can forge requests through XSS hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused
Jun 17, 2026 · NIST NVD
Updated
hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).
Affected
- Hackage hackage-server0.4, 0.5.0
Sources
- CVE.orgVulnerability recordCVE-2026-40471
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40471
hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions
nvd.nist.gov - OSV.devPackage advisoryHSEC-2026-0002
Hackage CSRF vulnerability
osv.dev