Live › vulnerability › CVE-2026-111883
Go to dashboardLocust through 2.46.7 accepts GET requests to /stop and /stats/reset without checking the request origin. A malicious web page visited by an operator can stop running load tests and wipe recorded performance statistics.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the Locust web UI (the browser-facing dashboard) on a version through 2.46.7, where an operator with a browser session can be lured to a malicious page. Headless runs without the web UI are not exposed through this path. Teams on newer releases can skip it.
No product ranges from the sources yet.
pip show locust and compare the version with 2.46.72.46.7 (fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.
This page as .md · .json · in your agent: get_signal("CVE-2026-111883")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.