CVE-2026-92751
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter
- State
- Published
- Severity
- 7.2 High
- Published
- Sep 16, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 16, 2026
Description
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.2 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
CMAKyahoo |
|
References
- GitHub Issue #935issue-tracking
- https://github.com/yahoo/CMAKproduct
- httpFilters installs only BasicAuthenticationFilter, no CSRFFiltertechnical-description
- VulnCheck Advisory: CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.