Luanti Vulnerability Exposes Insecure Environments via Crafted Mods

The National Vulnerability Database (NVD) has detailed a critical flaw, CVE-2026-40960, affecting Luanti versions prior to 5.15.2. This vulnerability could allow unauthorized access to sensitive environments by exploiting how the system handles trusted or HTTP-accessible modules.

According to NVD, if a Luanti instance has modules listed under secure.trusted_mods or secure.http_mods, a malicious actor could craft a specific module to intercept requests. This interception could grant the attacker access to an otherwise insecure environment or HTTP API, bypassing intended security controls. The severity is underscored by a CVSS score of 8.1, categorized as HIGH.

The vulnerability, identified under CWE-670 (Always Use Input Validation), highlights a common pitfall in application security where trust is implicitly granted based on module configuration, rather than strict input validation and access control. While specific affected products weren’t detailed by NVD, any system relying on Luanti’s module handling for security could be at risk.