PT-2026-30990 · Unknown · Redwoodsdk

Zebbern · CVE-2026-39371 · Published 2026-04-07 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions RedwoodSDK versions 1.0.0-beta.50 through 1.0.5

Description RedwoodSDK server functions exported from "use server" files were callable via GET requests, circumventing intended HTTP method restrictions. In applications using cookie-based authentication, this permitted cross-site GET requests to initiate state modifications, as browsers include SameSite=Lax cookies with top-level GET requests. This impacted all server functions, including serverAction() handlers and directly exported functions within "use server" files.

Recommendations Update to RedwoodSDK version 1.0.6 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-39371

GHSA-X8RX-789C-2PXQ

Affected Products

Redwoodsdk

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39371.json · Exploit
• https://github.com/redwoodjs/sdk/security/advisories/GHSA-x8rx-789c-2pxq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x8rx-789c-2pxq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-39371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39371 · Security Note
• https://github.com/redwoodjs/sdk · Note
• https://twitter.com/CVEnew/status/2041711905883222287 · Twitter Post