CVE-2026-67990

Katalog CVE

CVSS 5.4 · Medium EPSS 0,18%

Kerentanan Cross-Site Request Forgery (CSRF). Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 3.1

5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://gist.github.com/Zykis1024/cec690012eecac53f408e78d2b569f06
• https://github.com/basecamp/upright
• https://github.com/basecamp/upright/blob/efe4f2e5254ac6e57e45d2261804cca74dbbca3f/app/controllers/upright/aler...
• https://github.com/basecamp/upright/blob/efe4f2e5254ac6e57e45d2261804cca74dbbca3f/app/controllers/upright/prom...