CVE-2026-111883

MEDIUM 5.4

Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.

CWE	CWE-352
Vendor	locustio
Product	locust
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for locustio locust

Be the first to know when new medium vulnerabilities affecting locustio locust are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

locustio / locust

0 ≤ 2.46.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/locustio/locust/issues/3566 github.com: https://github.com/locustio/locust/commit/3a1d0caa5bde59494ede55f513fcb4becbf406a0 github.com: https://github.com/locustio/locust/blob/2.46.7/locust/web.py vulncheck.com: https://www.vulncheck.com/advisories/locust-through-2.46.7-csrf-via-web-ui-stop-and-stats-reset

Credits

George Chen