CVE-2026-18819

RackTables cross-site request forgery

State: Published
Severity: 5.3 Medium
Published: Aug 4, 2026
Updated: Aug 5, 2026
Reserved: Aug 4, 2026

Description

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project maintainer confirms: "[I]t seems plausible, in that RackTables does not at this time have any CSRF prevention. You may assign a CVE ID to this, but there is no guarantee it will be handled in urgent, or even timely, manner, or at all."

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:U/RC:R	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:U/RC:R	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:U/RC:C	VulDB

Weaknesses

CWE-352 Cross-Site Request Forgery
CWE-862 Missing Authorization

Affected Products

Product	Versions
RackTablesn/a	0.1Affected 0.2Affected 0.3Affected 0.4Affected 0.5Affected 0.6Affected 0.7Affected 0.8Affected 0.9Affected 0.10Affected 0.11Affected 0.12Affected 0.13Affected 0.14Affected 0.15Affected 0.16Affected 0.17Affected 0.18Affected 0.19Affected 0.20Affected 0.21Affected 0.22.0Affected e5fff9f8aab339798ed47e8c6d7d977ed97a82bdAffected

References

VDB-385818 | RackTables cross-site request forgeryvdb-entry
VDB-385818 | CTI Indicators (IOB, IOC)signaturepermissions-required
CVE-2026-18819 | CVE Analysis and Reportthird-party-advisory
Submit #857970 | RackTables f14f64e65ac8d806b1f64a981acb3c6870eeae37 Cross-Site Request Forgerythird-party-advisory
https://github.com/fa1c4/security-advisories/blob/main/RackTables/RackTables_CSRF_report.mdrelated
https://github.com/fa1c4/security-advisories/tree/main/RackTables/PoCexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.