Critical CSRF Flaw in hackage-server Poses Supply Chain Risk

The National Vulnerability Database has disclosed CVE-2026-40471, a critical Cross-Site Request Forgery (CSRF) vulnerability in hackage-server. This flaw, carrying a CVSS score of 9.6, essentially allows scripts on external sites to trigger requests against a hackage-server instance. The implications are severe: an attacker could exploit this to abuse latent credentials, potentially uploading malicious packages or executing administrative actions without the user’s explicit consent.

This isn’t just about authenticated users. The National Vulnerability Database notes that even unauthenticated actions, like creating new user accounts, could be abused. This opens the door for attackers to establish persistent footholds or manipulate package repositories, directly impacting the integrity of the software supply chain. The lack of CSRF protection is a fundamental security oversight that can lead to widespread compromise.

For defenders, this means assuming compromise if you’re running an unpatched hackage-server. An attacker’s calculus here is straightforward: leverage a common web vulnerability to gain control over a critical component in the software delivery pipeline. The potential for injecting malicious code into widely used packages is a high-reward scenario, making this a prime target for sophisticated adversaries.