PT-2026-32987 · Hackage · Hackage-Server

Published 2026-03-28 · Updated 2026-04-23 · CVE-2026-40471

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions hackage-server (affected versions not specified)

Description The software lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. This allowed scripts on foreign sites to trigger requests to the server, potentially abusing latent credentials to upload packages or perform administrative actions. Additionally, some unauthenticated actions, such as creating new user accounts, could be abused.

Recommendations Apply the update that implements CSRF middleware to check the Sec-Fetch-Site header for all requests using HTTP methods other than GET, HEAD, and OPTIONS.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-40471

HSEC-2026-0002

Affected Products

Hackage-Server

References · 5

• https://osv.dev/vulnerability/HSEC-2026-0002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40471 · Security Note
• https://github.com/haskell/hackage-server/commit/2de3ae45082f8f3f29a41f6aff620d09d0e74058 · Note
• https://github.com/haskell/security-advisories · Note
• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export · Note