{"id":"CVE-2026-111883","title":"Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset","summary":"Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page …","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-352"],"vendor":"locustio","product":"locust","affected":["locust <= 2.46.7"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T13:55:06.849Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111883","references":[{"url":"https://github.com/locustio/locust/issues/3566"},{"url":"https://github.com/locustio/locust/commit/3a1d0caa5bde59494ede55f513fcb4becbf406a0"},{"url":"https://github.com/locustio/locust/blob/2.46.7/locust/web.py"},{"url":"https://www.vulncheck.com/advisories/locust-through-2.46.7-csrf-via-web-ui-stop-and-stats-reset","label":"VulnCheck Advisory: Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T14:30:01.079Z","slug":"CVE-2026-111883","body":"## Overview\n\nLocust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.\n\n## Affected\n\n- `locust <= 2.46.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}