Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset

Advisories

Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset

Severity: medium
Date: 10/19/2026
Affecting: locust <= 2.46.7
CVE: CVE-2026-111883
CWE: CWE-352 Cross-Site Request Forgery (CSRF)
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
References: https://github.com/locustio/locust/issues/3566
https://github.com/locustio/locust/commit/3a1d0caa5bde59494ede55f513fcb4becbf406a0
https://github.com/locustio/locust/blob/2.46.7/locust/web.py
Credit: George Chen
Description: Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo