What is the CVSS score of CVE-2026-40471?

CVE-2026-40471 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of hackage-server are affected by CVE-2026-40471?

The Haskell package repository (Hackage) contains a critical CSRF vulnerability that could allow attackers to inject malicious packages into the central distribution system, creating supply chain…

How to fix or mitigate CVE-2026-40471?

Within 24 hours: inventory Haskell dependencies in your environments and assess organizational exposure; immediately notify development teams and initiate monitoring of authentication logs for unauthorized Hackage account activity. Within 7 days: coordinate with infrastructure teams to implement WAF rules blocking anomalous cross-origin requests to Hackage endpoints, enforce SameSite=Strict cookie policies if proxying Hackage traffic, and require re-authentication for all administrative operations. Within 30 days: audit recent Hackage package uploads for integrity anomalies, monitor vendor security advisories for a CSRF-token implementation patch release, and establish package verification controls to validate package provenance before deployment until a vendor patch is released.

hackage-server CVE-2026-40471

EUVD-2026-25234 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-23 redhat-cnalr

GHSA-mf84-vmqg-86fm

CSRF

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

vuln.today AI

8.8 HIGH

Remote low-complexity CSRF needing victim interaction (UI:R) and no attacker auth (PR:N); scope change into app context; integrity high (forged uploads/admin), but confidentiality only low since CSRF cannot read cross-origin responses.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:43 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 16:00 euvd

EUVD-2026-25234

CVE Published

Apr 23, 2026 - 14:56 nvd

CRITICAL 9.6

DescriptionCVE.org

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions. Some unauthenticated actions could also be abused (e.g. creating new user accounts).

AnalysisAI

Cross-Site Request Forgery in hackage-server (the Haskell Hackage package repository server) allows a malicious web page to force a victim's authenticated browser to issue state-changing requests, letting attackers upload packages or perform administrative actions using the victim's latent session, and to abuse unauthenticated flows such as creating new user accounts. The flaw stems from a site-wide absence of CSRF tokens across endpoints. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 4th percentile), but technical impact is rated total.

Technical ContextAI

hackage-server is the open-source Haskell application that powers Hackage (hackage.haskell.org), the central repository for Haskell packages, and is also self-hosted for private/mirror deployments. The root cause is CWE-352 (Cross-Site Request Forgery): the application authorizes state-changing HTTP requests based solely on the ambient browser session (cookies) without verifying a per-request anti-CSRF token or validating the request origin. Because the check is missing uniformly across endpoints rather than on a single form, both authenticated administrative actions (e.g., package upload) and unauthenticated actions (e.g., account creation) can be driven cross-origin. No specific library CPE was supplied in the input, so exact affected version boundaries are not enumerated in NVD data provided here.

Affected ProductsAI

The affected product is hackage-server, the Haskell package repository server software (the codebase behind hackage.haskell.org and self-hosted mirrors). The input data does not include CPE strings or an enumerated fixed/affected version range, so precise version boundaries are not confirmed from the provided sources; authoritative version detail is expected in the Haskell Security Advisory HSEC-2026-0002 (https://osv.dev/vulnerability/HSEC-2026-0002). Additional references: VulDB advisory (https://vuldb.com/vuln/359155) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-40471), tracked in the EU database as EUVD-2026-25234.

RemediationAI

Upgrade to a fixed hackage-server release as identified in the Haskell Security Advisory HSEC-2026-0002 (https://osv.dev/vulnerability/HSEC-2026-0002); an exact patched version was not provided in the input data and should be confirmed against that advisory before deployment, so treat the fix as 'per vendor advisory' rather than a specific tagged version. Until patched, operators of self-hosted instances can reduce exposure by fronting the server with a reverse proxy that enforces Origin/Referer checks on state-changing (POST/PUT/DELETE) requests, setting session cookies to SameSite=Strict or SameSite=Lax to blunt cross-site cookie attachment (trade-off: may affect legitimate cross-site links into authenticated flows), and restricting administrative and upload endpoints to trusted networks or VPN (trade-off: reduces convenience for remote maintainers). Advise privileged users to log out or use a separate browser profile for administration to avoid latent-credential abuse. Consult the VulDB (https://vuldb.com/vuln/359155) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-40471) references for updates.