CVE-2026-111883
Received Received - Intake

Cross-Site Request Forgery in Locust Load Testing Tool

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111883
EUVD
EUVD-2026-104320

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
locustio locust 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Locust versions up to 2.46.7. It allows remote attackers to stop active load tests or reset performance statistics by sending malicious GET requests to the /stop and /stats/reset endpoints. Attackers can trick authenticated users into visiting a malicious page that triggers these requests.

Detection Guidance

To detect this vulnerability, check if your Locust instance (version <= 2.46.7) has the /stop and /stats/reset endpoints accessible via GET requests. Use curl to test these endpoints: curl -X GET http://<locust-server>/stop and curl -X GET http://<locust-server>/stats/reset. If these requests succeed without authentication or CSRF protection, the system is vulnerable.

Impact Analysis

An attacker could terminate ongoing load tests disrupting testing operations or delete recorded performance data corrupting results. This could lead to inaccurate performance metrics or wasted resources if tests need restarting. The impact is limited to actions via the web UI and requires an authenticated user to visit a malicious page.

Compliance Impact

This vulnerability could impact compliance with standards requiring data integrity and auditability, such as GDPR and HIPAA. By allowing unauthorized termination of load tests or deletion of statistics, it risks tampering with performance data that may be used for compliance reporting or security audits. Unauthorized changes to recorded results could undermine the reliability of such data for regulatory purposes.

Mitigation Strategies

Immediately update Locust to a version that changes the /stop and /stats/reset endpoints to POST requests only. Alternatively, restrict access to these endpoints via network-level controls or disable the web UI if not required. Ensure CSRF tokens or SameSite cookie attributes are enforced if using Flask-Login.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111883. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart