Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92751— CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter

Quick assessment

Affected
yahoo CMAK
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CMAK 3.0.0.6 及更早版本未安装跨站请求伪造（CSRF）过滤器，使得攻击者能够代表已认证的操作人员执行状态变更操作。攻击者可以构造隐藏表单，提交到诸如“删除主题”或“修改集群配置”等破坏性端点，并利用操作人员的 HTTP 基本认证凭据或带有 且未设置 属性的 Cookie 来实现攻击。

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92751

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter
Source: CVE Program / CVE List V5
Vulnerability Description
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
yahoo CMAK 0 ~ 3.0.0.6 -

II. Public POCs for CVE-2026-92751

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92751

请登录查看更多情报信息。

Other References for CVE-2026-92751 (4)

IV. Related Vulnerabilities

Same product: CMAK
Same vendor: yahoo
Same weakness: CWE-352

V. Comments for CVE-2026-92751

No comments yet

Leave a comment