---
id: "CVE-2026-33057"
kind: "vulnerability"
aliases: ["CVE-2026-33057"]
title: "Mesop: unauthenticated Base64 payloads in request body run arbitrary code"
severity: "critical"
cvss: 9.8
epss: 0.04111
exploited: false
status: "open"
category: "package"
products: [{"name": "mesop-dev mesop", "fixed": ["1.2.3"], "affected": "< 1.2.3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cloudflare", "lab-disclosure", "mesop", "package", "python", "self-hosted", "web-apps"]
not_affected_if: ["mesop-1.2.3-or-later", "mesop-not-used"]
published_at: "2026-03-20T08:16:11+00:00"
first_seen_at: "2026-10-24T19:12:57+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/", "first_seen_at": "2026-10-24T19:12:57+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33057", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-33057", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Mesop: unauthenticated Base64 payloads in request body run arbitrary code

Mesop, a Python UI framework, has a flaw where an unauthenticated attacker sends a specially crafted Base64-encoded request body and executes arbitrary code on the server. Cloudflare's WAF now blocks this pattern, but the framework itself must be upgraded to remove the flaw.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mesop-dev mesop affected < 1.2.3 fixed 1.2.3

## How to check

- Run `pip show mesop` or inspect the lockfile to find the installed Mesop version; anything below `1.2.3` is affected.
- Check whether Cloudflare WAF rule "Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057" is active; it is a block-mode detection, not a fix.

## Fix

- Upgrade Mesop to `1.2.3` or later.
- Until upgraded, keep the Cloudflare Managed Ruleset rule for CVE-2026-33057 in Block mode, which is a mitigation only.

## Timeline

- 2026-10-24T19:12:57+00:00 lab https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/ — Cloudflare: WAF Release - 2026-04-15 · Changelog
- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-33057
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-33057

## Documents

- [advisory] Cloudflare: WAF Release - 2026-04-15 · Changelog https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/

## From the sources

WAF Release - 2026-04-15 · Changelog

# Changelog

New updates and improvements at Cloudflare.

April 15, 2026

## WAF Release - 2026-04-15

This week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).

Key Findings

- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.
- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.
- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.

Impact

Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule "React Server - DOS - CVE:CVE-2026-23864 - 1" (ID: ...61680354) |
| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_