CVE-2026-104059: Lektor CMS CSRF Vulnerability

CVE-2026-104059 Overview

CVE-2026-104059 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Lektor static content management system. Lektor versions 3.3.14 and 3.4.0b15 expose state-changing admin API endpoints without CSRF tokens, Origin or Referer validation, CORS configuration, or Host allowlisting. Unauthenticated attackers can trigger admin actions from a malicious web page when a Lektor user visits it. The affected endpoints include newattachment, deleterecord, build, clean, and publish. Attackers can write arbitrary files, delete pages, wipe build output, trigger deployment, and chain DNS rebinding against read endpoints to disclose project data.

Critical Impact
Remote attackers can modify site content, delete records, and force publication of attacker-controlled changes through a victim's authenticated admin session.

Affected Products

Lektor 3.3.14
Lektor 3.4.0b15
Lektor admin API blueprint endpoints (newattachment, deleterecord, build, clean, publish)

Discovery Timeline

2026-10-01 - CVE-2026-104059 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104059

Vulnerability Analysis

Lektor runs a local admin server that exposes a Flask blueprint for authoring and publishing content. The admin API accepts browser-originated requests with ambient credentials from the local session. The blueprint applies no CSRF token verification on mutating routes. It also skips Origin and Referer header checks, does not configure CORS, and does not enforce a Host allowlist. An attacker-controlled page can issue cross-origin POST requests that the admin server processes as if the authenticated user initiated them.

The newattachment endpoint accepts file uploads, so an attacker can plant arbitrary files inside the project tree. The deleterecord endpoint removes pages. The build and clean endpoints manipulate build output. The publish endpoint pushes site content to configured deployment targets, including attacker-tainted changes.

Root Cause

The root cause is missing anti-CSRF controls on the admin API blueprint. The server trusts any authenticated browser request without validating request origin or including a synchronizer token. Because the admin binds to a predictable local address, DNS rebinding further defeats same-origin assumptions and extends the attack surface to read endpoints.

Attack Vector

Exploitation requires a Lektor author to visit a malicious page while an admin session is active. The attacker's page submits forged POST requests to the local admin API or performs DNS rebinding to switch a victim-resolved hostname to the Lektor admin host. No authentication is required on the attacker side; the browser supplies session context automatically. See the VulnCheck Security Advisory and the GitHub Gist PoC Code for proof-of-concept details.

// No verified exploit code reproduced here.
// Refer to the linked VulnCheck advisory and public PoC gist for technical details.

Detection Methods for CVE-2026-104059

Indicators of Compromise

Unexpected files appearing under the Lektor project assets or content directories without matching author activity.
Admin API requests to /newattachment, /deleterecord, /build, /clean, or /publish with missing or external Origin and Referer headers.
Deployment or publish events in build logs that do not align with scheduled release windows.
DNS queries resolving external hostnames to 127.0.0.1 or RFC1918 addresses on author workstations.

Detection Strategies

Inspect HTTP logs for admin API POST requests where Origin is absent or does not match the admin host.
Correlate publish and build endpoint invocations with authenticated user activity in the editor UI.
Monitor file system changes under the Lektor project root for writes not initiated by the Lektor process tree.

Monitoring Recommendations

Enable verbose request logging on the Lektor admin server and ship logs to a central platform for correlation.
Alert on short-interval DNS responses that rebind external domains to loopback or private addresses on developer hosts.
Track Git commits and deployment artifacts for unauthorized content changes that follow browser activity.

How to Mitigate CVE-2026-104059

Immediate Actions Required

Stop running the Lektor admin server on multi-user workstations or shared browsing sessions until a patched version is deployed.
Bind the admin server to 127.0.0.1 and restrict access through SSH tunnels rather than exposing it to local network interfaces.
Use a dedicated browser profile for Lektor administration to isolate ambient session credentials from general browsing.
Review recent publish and newattachment activity for unexpected content changes before the next deployment.

Patch Information

At publication time, the NVD entry does not list fixed versions. Monitor the VulnCheck Security Advisory and the Lektor project repository for a release addressing the CSRF controls in the admin blueprint. Upgrade from 3.3.14 and 3.4.0b15 once a patched build is available.

Workarounds

Place the Lektor admin server behind a reverse proxy that enforces strict Origin and Referer validation on state-changing routes.
Configure host operating system DNS resolution to pin the admin hostname to loopback and reject external resolutions, blunting DNS rebinding.
Terminate the admin server when not actively authoring content to eliminate the window where CSRF requests can land.
Apply browser extensions or local firewall rules that block cross-origin requests targeting the Lektor admin port.

bash

# Example: restrict Lektor admin server to loopback only
lektor server --host 127.0.0.1 --port 5000

# Example: block external access to the admin port via iptables
iptables -A INPUT -p tcp --dport 5000 ! -s 127.0.0.1 -j DROP