CVE-2026-18819

Description

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project maintainer confirms: "[I]t seems plausible, in that RackTables does not at this time have any CSRF prevention. You may assign a CVE ID to this, but there is no guarantee it will be handled in urgent, or even timely, manner, or at all."

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-352, CWE-862
Reserved: 2026-08-04
Published: 2026-08-04 22:45 UTC
Last updated: 2026-08-04 22:45 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18819.json

Affected products (1)

Vendor	Product	Versions	Platforms
n/a	RackTables	`0.1` (affected), `0.2` (affected), `0.3` (affected), `0.4` (affected), `0.5` (affected), `0.6` (affected), `0.7` (affected), `0.8` (affected), `0.9` (affected), `0.10` (affected), `0.11` (affected), `0.12` (affected), `0.13` (affected), `0.14` (affected), `0.15` (affected), `0.16` (affected), `0.17` (affected), `0.18` (affected), `0.19` (affected), `0.20` (affected), `0.21` (affected), `0.22.0` (affected), `e5fff9f8aab339798ed47e8c6d7d977ed97a82bd` (affected)	—

Vendor references (6)

References embedded in the original CVE record by the assigning CNA.

VDB-385818 | RackTables cross-site request forgery vdb-entry
VDB-385818 | CTI Indicators (IOB, IOC) signaturepermissions-required
CVE-2026-18819 | CVE Analysis and Report third-party-advisory
Submit #857970 | RackTables f14f64e65ac8d806b1f64a981acb3c6870eeae37 Cross-Site Request Forgery third-party-advisory
https://github.com/fa1c4/security-advisories/blob/main/RackTables/RackTables_CSRF_report.md related
https://github.com/fa1c4/security-advisories/tree/main/RackTables/PoC exploit

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-18819.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:racktables:racktables:*:*:*:*:*:*:*:*"
          ],
          "product": "RackTables",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "0.1"
            },
            {
              "status": "affected",
              "version": "0.2"
            },
            {
              "status": "affected",
              "version": "0.3"
            },
            {
              "status": "affected",
              "version": "0.4"
            },
            {
              "status": "affected",
              "version": "0.5"
            },
            {
              "status": "affected",
              "version": "0.6"
            },
            {
              "status": "affected",
              "version": "0.7"
            },
            {
              "status": "affected",
              "version": "0.8"
            },
            {
              "status": "affected",
              "version": "0.9"
            },
            {
              "status": "affected",
              "version": "0.10"
            },
            {
              "status": "affected",
              "version": "0.11"
            },
            {
              "status": "affected",
              "version": "0.12"
            },
            {
              "status": "affected",
              "version": "0.13"
            },
            {
              "status": "affected",
              "version": "0.14"
            },
            {
              "status": "affected",
              "version": "0.15"
            },
            {
              "status": "affected",
              "version": "0.16"
            },
            {
              "status": "affected",
              "version": "0.17"
            },
            {
              "status": "affected",
              "version": "0.18"
            },
            {
              "status": "affected",
              "version": "0.19"
            },
            {
              "status": "affected",
              "version": "0.20"
            },
            {
              "status": "affected",
              "version": "0.21"
            },
            {
              "status": "affected",
              "version": "0.22.0"
            },
            {
              "status": "affected",
              "version": "e5fff9f8aab339798ed47e8c6d7d977ed97a82bd"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "fa1c4 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project maintainer confirms: \"[I]t seems plausible, in that RackTables does not at this time have any CSRF prevention. You may assign a CVE ID to this, but there is no guarantee it will be handled in urgent, or even timely, manner, or at all.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:U/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:U/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:U/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-Site Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T22:45:11.241Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-385818 | RackTables cross-site request forgery",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/385818"
        },
        {
          "name": "VDB-385818 | CTI Indicators (IOB, IOC)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/385818/cti"
        },
        {
          "name": "CVE-2026-18819 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-18819"
        },
        {
          "name": "Submit #857970 | RackTables f14f64e65ac8d806b1f64a981acb3c6870eeae37 Cross-Site Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/857970"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/fa1c4/security-advisories/blob/main/RackTables/RackTables_CSRF_report.md"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/fa1c4/security-advisories/tree/main/RackTables/PoC"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-04T15:13:22.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "RackTables cross-site request forgery",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-18819",
    "datePublished": "2026-08-04T22:45:11.241Z",
    "dateReserved": "2026-08-04T13:08:18.020Z",
    "dateUpdated": "2026-08-04T22:45:11.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}