CVE-2026-67990: CSRF
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Re-enable Rails CSRF protection for the Alertmanager proxy controller (the upstream-commit behavior described as disabling CSRF protection should be reverted).
basecamp/upright Alertmanager proxy controller Rails CSRF protection = enabled - Configuration
Re-enable Rails CSRF protection for the Prometheus proxy controller (the upstream-commit behavior described as disabling CSRF protection should be reverted).
basecamp/upright Prometheus proxy controller Rails CSRF protection = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67990?
CVE-2026-67990 has a risk score of 48, indicating a significant vulnerability.
How do I fix CVE-2026-67990?
To mitigate CVE-2026-67990, enable Rails CSRF protection for both the Alertmanager and Prometheus proxy controllers.
What type of attack does CVE-2026-67990 enable?
CVE-2026-67990 allows an unauthenticated attacker to perform cross-site request forgery (CSRF) attacks.
Which software is affected by CVE-2026-67990?
CVE-2026-67990 impacts the basecamp/upright software component.
When was CVE-2026-67990 published?
CVE-2026-67990 was published on August 13, 2026.