Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92751CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter

High 8.1

In plain English

A high-severity cross-site request forgery in CMAK from yahoo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 81.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without SameSite protection.

Affected products (as reported)

Vendor	Product	Versions
yahoo	CMAK	0 – through 3.0.0.6

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

GitHub Issue #935 issue-tracking
https://github.com/yahoo/CMAK product
httpFilters installs only BasicAuthenticationFilter, no CSRFFilter technical-description
VulnCheck Advisory: CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter third-party-advisory