locust vulnerabilities

CVEs whose affected-version data names the locust package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111883Medium· 5.4

today

Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page …

▾ Sunlitlocustio · locustvia CVEORG