CVE-2026-18819

MediumCVSS 4.3

Published: 04/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

RackTables up to 0.22.0 has a cross-site request forgery vulnerability. The attack can be performed remotely, and the exploit has been publicly disclosed. The project currently lacks CSRF protections.

Risk Assessment

CSRF attacks could allow unauthorized actions on behalf of an authenticated administrator, potentially leading to configuration or data modification.

Recommendation

Apply temporary mitigations such as additional authentication and monitor RackTables updates for fixes.

Other vulnerabilities in RackTables

CVE-2020-19611Medium
A Cross Site Scripting (XSS) vulnerability exists in the redirect module of Racktables version 0.21.2. An attacker can inject arbitrary web script or HTML via the op parameter.

Original NVD description (English source)

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project maintainer confirms: "[I]t seems plausible, in that RackTables does not at this time have any CSRF prevention. You may assign a CVE ID to this, but there is no guarantee it will be handled in urgent, or even timely, manner, or at all."

Vulnerability data from NVD (NIST) · CISA KEV · EPSS