EUVD-2026-23151Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
10DescriptionCVE.org
Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment. If at least one mod is listed as secure.trusted_mods or secure.http_mods, then a crafted mod can intercept the request for the insecure environment or HTTP API, and also receive access to it.
AnalysisAI
Logic error in Luanti 5 (formerly Minetest) game engine before 5.15.2 allows malicious mods to gain unauthorized access to security-restricted APIs by intercepting mod environment setup. When any mod is designated as trusted (via secure.trusted_mods or secure.http_mods), a specially crafted mod can exploit the environment initialization sequence to receive the insecure environment or HTTP API access intended only for trusted mods. CVSS 8.1 reflects local attack vector with high complexity but no authentication required and scope change with high confidentiality/integrity/availability impact. GitHub security advisory and two fix commits confirm patch availability. No CISA KEV listing or public exploit code identified at time of analysis.
Technical ContextAI
Luanti (CVE-2026-40960 affects cpe:2.3:a:luanti:luanti) is an open-source voxel game engine supporting user-created modifications (mods) with restricted and unrestricted API environments. The secure.trusted_mods and secure.http_mods configuration settings designate which mods may access privileged APIs like HTTP networking or file system operations. CWE-670 (Always-Incorrect Control Flow Implementation) indicates a logic flaw in the mod initialization sequence. The vulnerability manifests during environment provisioning: when the engine iterates through loaded mods to assign API access, a maliciously-named or sequenced mod can position itself to receive the privileged environment handle before or instead of the legitimately trusted mod. This breaks the security model that assumes only explicitly trusted mods can access dangerous capabilities like arbitrary HTTP requests or unrestricted Lua functions.
RemediationAI
Upgrade to Luanti 5.15.2 or later, which contains fixes in commits 0faf529bc4b89e70a275ed1162047815118f2413 and 827fd4cf7f989482b2dad381fa4afd642ea73e8c that correct the mod environment initialization logic. The patches enforce proper access control during environment provisioning to prevent interception by untrusted mods. For environments unable to upgrade immediately, remove all entries from secure.trusted_mods and secure.http_mods configurations to eliminate the trigger condition - this disables HTTP API and insecure environment access for all mods, effectively closing the attack vector but breaking functionality of mods that legitimately require those capabilities. Alternatively, implement strict mod vetting procedures: only install mods from verified sources, review mod code before deployment, and disable user-uploaded mods on public servers. Note that disabling trusted mod features may break existing gameplay mechanics that depend on HTTP lookups or file operations. Advisory and technical details: https://github.com/luanti-org/luanti/security/advisories/GHSA-22c4-238c-m5j4
Lua sandbox escape in Luanti 5.x (formerly Minetest) game engine allows malicious mod code to break out of LuaJIT securi
Remote code execution in Luanti 5.0.0 through 5.15.1 allows authenticated attackers to escape the Lua sandbox via malici
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today