High severity · published Sep 16, 2026
CVE-2026-92751
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMAK · yahoo
through 3.0.0.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92751
github.com
https://github.com/yahoo/CMAK
github.com
https://github.com/yahoo/CMAK/blob/3.0.0.6/app/loader/KafkaManagerLoader.scala#L48
github.com
https://github.com/yahoo/CMAK/issues/935
www.vulncheck.com
https://www.vulncheck.com/advisories/cmak-through-3.0.0.6-cross-site-request-forgery-via-missing-csrf-filter
More from CMAK
5.4
CVE-2026-92778
CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes