CVE-2026-67990CWE-352csrf

CVE-2026-67990

Medium · published August 13, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-13T18:17Z
References (4)
https://gist.github.com/Zykis1024/cec690012eecac53f408e78d2b569f06 · [email protected]https://github.com/basecamp/upright · [email protected]https://github.com/basecamp/upright/blob/efe4f2e5254ac6e57e45d2261804cca74dbbca3f/app/controllers/upright/alertmanager_proxy_controller.rb#L2 · [email protected]https://github.com/basecamp/upright/blob/efe4f2e5254ac6e57e45d2261804cca74dbbca3f/app/controllers/upright/prometheus_proxy_controller.rb#L2 · [email protected]
EPSS history
Timeline
  • 13 AUG 00:00Z
    basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers
    cvelistv5