CVE-2026-111883: Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset
Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Operators using the Locust Web UI are exposed if they can be induced to visit a malicious page while they have access to a Locust instance. The impact is limited to stopping running load tests or resetting their collected statistics.
What does an attacker need to exploit it?
The attacker does not need authentication or direct access to the Locust instance, but must lure a Web UI operator into loading a malicious page. That page can trigger cross-site GET requests to the affected endpoints.
Which actions can be triggered?
The affected GET endpoints are /stop, which can terminate a running swarm, and /stats/reset, which can wipe recorded performance results.