CVE-2026-18516: Crafty Controller XSS Vulnerability

CVE-2026-18516 Overview

CVE-2026-18516 is a stored cross-site scripting (XSS) vulnerability in the Audit Logs component of Crafty Controller. The flaw stems from improper output escaping [CWE-116] when HTTP header values are rendered in the audit log interface. A remote, unauthenticated attacker can inject malicious script content through HTTP headers, which is then stored and executed when an administrator views the logs. Successful exploitation leads to session compromise, administrative action hijacking, and potential pivot into the Minecraft server management console.

Critical Impact
Unauthenticated attackers can achieve stored XSS execution in an administrator's browser session, enabling full compromise of the Crafty Controller management interface.

Affected Products

Crafty Controller (Crafty-4)
Audit Logs component
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2026-10-16 - CVE-2026-18516 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2026-18516

Vulnerability Analysis

The vulnerability resides in the Audit Logs feature of Crafty Controller, a web-based management panel for Minecraft servers. The application records attributes of incoming HTTP requests, including header values, and persists them in the audit log store. When an authenticated administrator loads the audit log view, the stored header content is rendered without proper encoding. Because the injection point is reachable before authentication, no credentials are required to plant the payload. The persisted script executes in the context of the administrator's session, giving the attacker full control over actions the administrator can perform in the web interface.

Root Cause

The root cause is improper encoding of output [CWE-116]. HTTP header values that originate from untrusted clients are written to the audit log and later emitted into HTML without context-appropriate escaping. The rendering layer treats the header strings as safe markup rather than untrusted text, allowing arbitrary HTML and JavaScript to be interpreted by the browser.

Attack Vector

An attacker sends a crafted HTTP request to the Crafty Controller web endpoint with a malicious payload embedded in a header value. The server logs the request to the audit trail. When an administrator subsequently opens the Audit Logs page, the browser parses the injected markup and executes the attacker's script. The attack requires user interaction from an administrator but no authentication from the attacker. See the GitLab Work Item #743 for upstream technical details.

Detection Methods for CVE-2026-18516

Indicators of Compromise

Audit log entries containing HTML tags, <script> fragments, event handler attributes, or javascript: URIs within header fields
Unexpected outbound requests originating from administrator browser sessions shortly after viewing audit logs
New or modified Crafty Controller user accounts, API tokens, or server configurations that lack a corresponding administrative action trail

Detection Strategies

Inspect reverse proxy and application logs for inbound requests containing script-like payloads in User-Agent, Referer, X-Forwarded-For, or custom headers
Alert on audit log records where header values contain angle brackets, encoded script tokens, or unusually long strings
Correlate administrator session activity with anomalous API calls executed immediately after audit log page loads

Monitoring Recommendations

Enable verbose web server access logging in front of Crafty Controller and retain logs for forensic review
Monitor browser Content Security Policy (CSP) violation reports from administrators accessing the management console
Track changes to administrative accounts, roles, and server configurations and flag changes without a matching interactive session

How to Mitigate CVE-2026-18516

Immediate Actions Required

Restrict network access to the Crafty Controller web interface using firewall rules, VPN, or an authenticated reverse proxy
Review existing audit log entries for malicious payloads and purge or quarantine affected records before administrator review
Rotate administrator credentials and API tokens if evidence of exploitation is found

Patch Information

Monitor the Crafty Controller GitLab project for the upstream fix and upgrade to the patched release as soon as it becomes available. Verify installations after upgrade by submitting a benign test header payload and confirming it renders as encoded text in the audit log view.

Workarounds

Place Crafty Controller behind a reverse proxy that strips or sanitizes non-standard request headers before they reach the application
Deploy a web application firewall (WAF) rule that blocks HTTP headers containing script tags, event handlers, or encoded JavaScript tokens
Limit administrator access to the Audit Logs page until the patch is applied, and avoid using privileged browser sessions when reviewing logs

bash

# Example nginx header sanitization in front of Crafty Controller
# Reject requests whose User-Agent or Referer contains HTML tags
map $http_user_agent $block_ua { "~*<|>|script|javascript:" 1; default 0; }
map $http_referer   $block_rf { "~*<|>|script|javascript:" 1; default 0; }

server {
    listen 443 ssl;
    server_name crafty.example.com;

    if ($block_ua) { return 400; }
    if ($block_rf) { return 400; }

    location / {
        proxy_pass http://127.0.0.1:8443;
        proxy_set_header Host $host;
    }
}