{"id":"CVE-2026-111883","title":"Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset","summary":"Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page …","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-352"],"vendor":"locustio","product":"locust","affected":["locust <= 2.46.7"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-22T02:44:49.569653Z"},"exploitAvailable":true,"published":"2026-10-19","updated":"2026-10-22","sourceUpdated":"2026-10-22T02:45:12.513Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111883","references":[{"url":"https://github.com/locustio/locust/issues/3566"},{"url":"https://github.com/locustio/locust/commit/3a1d0caa5bde59494ede55f513fcb4becbf406a0"},{"url":"https://github.com/locustio/locust/blob/2.46.7/locust/web.py"},{"url":"https://www.vulncheck.com/advisories/locust-through-2.46.7-csrf-via-web-ui-stop-and-stats-reset","label":"VulnCheck Advisory: Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset"}],"tags":["cve.org","exploit-available"],"epss":0.00194,"epssPercentile":0.09039,"ingestedAt":"2026-10-19T14:30:01.079Z","slug":"CVE-2026-111883","body":"## Overview\n\nLocust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.\n\n## Affected\n\n- `locust <= 2.46.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":227493,"id":"CVE-2026-111883","ts":1792639558282,"field":"exploit_available","old":"false","new":"true"}]}