{"id":"CVE-2026-111883","summary":"Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset","details":"Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.","modified":"2026-10-21T02:55:50.090075027Z","published":"2026-10-19T13:55:06.849Z","database_specific":{"cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111883.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111883.json"},{"type":"PACKAGE","url":"https://github.com/locustio/locust"},{"type":"ARTICLE","url":"https://github.com/locustio/locust/blob/2.46.7/locust/web.py"},{"type":"FIX","url":"https://github.com/locustio/locust/commit/3a1d0caa5bde59494ede55f513fcb4becbf406a0"},{"type":"REPORT","url":"https://github.com/locustio/locust/issues/3566"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111883"},{"type":"WEB","url":"https://pypi.org"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/locust-through-2.46.7-csrf-via-web-ui-stop-and-stats-reset"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/locustio/locust","events":[{"introduced":"0"},{"last_affected":"1fdcfd166afbd18b446557623bf0e95b64f5f5e2"},{"fixed":"3a1d0caa5bde59494ede55f513fcb4becbf406a0"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"2.46.7"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"3a1d0caa5bde59494ede55f513fcb4becbf406a0"}]}]}}],"versions":["2.46.7","2.46.6","2.46.5","2.46.4","2.46.3","2.46.2","2.46.1","2.46.0","2.45.0","2.44.4","2.44.3","2.44.2","2.44.1","2.44.0","2.43.4","2.43.3","2.43.2","2.43.1","2.43.0","2.42.6","2.42.5","2.42.4","2.42.3","2.42.2","2.42.1","2.42.0","2.41.6","2.41.5","2.41.4","2.41.3","2.41.2","2.41.1","2.41.0","2.40.5","2.40.4","2.40.3","2.40.2","2.40.0","2.40.1","2.39.1","2.39.0","2.38.1","2.38.0","2.37.14","2.37.13","2.37.12","2.37.11","2.37.10","2.37.9","2.37.8","2.37.7","2.37.6","2.37.5","2.37.4","2.37.3","2.37.2","2.37.1","2.37.0","2.36.2","2.36.1","2.36.0","2.35.0","2.34.1","2.34.0","2.33.2","2.33.1","2.33.0","2.32.9","2.32.10","2.32.8","2.32.7","2.32.6","2.32.5","2.32.4","2.32.3","2.32.2","2.32.1","2.32.0","2.31.8","2.31.7","2.31.6","2.31.5","2.31.4","2.31.3","2.31.2","2.31.0","2.31.1","2.30.0","2.29.1","2.29.0","2.28.0","2.27.0","2.26.0","2.25.0","2.24.1","2.24.0","2.23.1","2.23.0","2.22.0","2.21.0","2.20.1","2.20.0","2.19.1","2.19.0","2.18.4","2.18.3","2.18.2","2.18.1","2.18.0","2.17.0","2.16.1","2.16.0","2.15.1","2.15.0","2.14.2","2.14.1","2.14.0","2.13.2","2.13.1","2.13.0","2.12.2","2.12.1","2.12.0","2.11.1","2.11.0","2.10.2","2.10.1","2.10.0","2.9.0","2.8.6","2.8.5","2.8.4","2.8.3","2.8.2","2.8.1","2.8.0","2.7.3","2.7.2","2.7.1","2.7.0","2.6.1","2.6.0","2.5.1","2.5.0","2.4.3","2.4.2","2.4.1","2.4.0","2.2.3","2.2.2","2.2.1","2.2.0","2.2.0b0","2.1.0","2.0.0","2.0.0b4","2.0.0b3","2.0.0b2","2.0.0b1","2.0.0b0","1.6.0","1.5.3","1.5.2","1.5.1","1.5.0","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.2","1.3.1","1.3.0","1.2.3","1.2.2","1.2.1","1.2","1.1.1","1.1","1.0.3","1.0.2","1.0.1","1.0","1.0b2","1.0b1","0.14.5","0.14.4","0.14.3","0.14.2","0.14.1","0.14.0","0.13.5","0.13.4","0.13.3","0.13.2","0.13.1","0.13.0","0.12.2","0.12.1","0.12.0","0.11.1","0.11.0","0.10.0","v0.8","v0.8a3","v0.8a1","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7","v0.6.2","v0.6.1","v0.6","v0.5.1","v0.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111883.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}