CVE-2026-18819: RackTables CSRF Vulnerability

CVE-2026-18819 Overview

CVE-2026-18819 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting RackTables versions up to 0.22.0 (commit e5fff9f8aab339798ed47e8c6d7d977ed97a82bd). RackTables is an open-source datacenter and network asset management application. The flaw exists because RackTables does not implement CSRF prevention mechanisms across its state-changing endpoints. An attacker can craft a malicious web page that, when visited by an authenticated RackTables user, triggers unauthorized actions in the application. The project maintainer has publicly acknowledged the absence of CSRF protection and provided no guarantee of a timely fix. The exploit details have been disclosed publicly.

Critical Impact
Authenticated RackTables users who visit an attacker-controlled page can be coerced into performing state-changing actions in the application without consent, potentially altering inventory records, permissions, or configuration.

Affected Products

RackTables up to and including version 0.22.0
RackTables commit e5fff9f8aab339798ed47e8c6d7d977ed97a82bd and prior
All RackTables deployments without external CSRF mitigation

Discovery Timeline

2026-08-04 - CVE-2026-18819 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18819

Vulnerability Analysis

CVE-2026-18819 stems from the absence of anti-CSRF controls in the RackTables web application. State-changing HTTP requests do not require a per-session, unpredictable token that binds the request to the authenticated user's session. As a result, the application cannot distinguish between requests intentionally initiated by the user and forged requests triggered by a third-party origin.

Exploitation requires an authenticated RackTables user to interact with attacker-controlled content, such as clicking a link or loading a page hosting a hidden form or scripted request. The browser automatically attaches the user's session cookie to the cross-origin request, and the RackTables backend processes the action under the victim's privileges. The impact scope aligns with the victim's role, ranging from asset modification to administrative changes when a privileged user is targeted.

Root Cause

The root cause is a missing security control: RackTables does not generate, embed, or validate CSRF tokens on state-changing form submissions or API endpoints. The project maintainer confirmed in the disclosure that "RackTables does not at this time have any CSRF prevention." There is no upstream patch commitment.

Attack Vector

The attack is network-based and requires user interaction. The attacker hosts a page containing an HTML form, image tag, or JavaScript request that targets a RackTables endpoint. When an authenticated RackTables user loads the attacker's page, the browser issues the request with valid session cookies, and RackTables executes the action. No credentials, session tokens, or additional authentication factors are required from the attacker. Public proof-of-concept code has been published in the referenced GitHub advisory repository.

See the GitHub CSRF Security Advisory and the GitHub PoC Repository for the disclosed proof-of-concept details.

Detection Methods for CVE-2026-18819

Indicators of Compromise

Unexpected modifications to RackTables inventory records, object attributes, or user permissions that do not correlate with legitimate administrative activity.
HTTP POST or GET state-changing requests to RackTables endpoints with Referer or Origin headers pointing to external, untrusted domains.
Access logs showing authenticated actions immediately following the user visiting an unfamiliar external URL.

Detection Strategies

Inspect RackTables web server access logs for state-changing requests where the Referer header is absent or references a non-RackTables origin.
Correlate user-agent browsing telemetry with RackTables audit events to identify actions triggered from cross-origin contexts.
Deploy a web application firewall (WAF) rule that flags RackTables POST requests lacking a same-origin Referer or Origin header.

Monitoring Recommendations

Enable verbose access logging on the RackTables reverse proxy or web server, capturing Referer, Origin, and full request paths.
Alert on privileged RackTables account activity outside of established administrative maintenance windows.
Review the RackTables audit trail regularly for unexplained configuration or object changes.

How to Mitigate CVE-2026-18819

Immediate Actions Required

Restrict access to the RackTables interface to trusted management networks or via VPN to reduce exposure to browser-based CSRF delivery.
Instruct RackTables administrators to use a dedicated browser or browser profile for RackTables sessions and to log out immediately after use.
Deploy a reverse-proxy or WAF policy that rejects RackTables state-changing requests lacking a same-origin Referer or Origin header.

Patch Information

No official patch is available at the time of publication. The project maintainer stated there is "no guarantee it will be handled in urgent, or even timely, manner, or at all." Operators must rely on compensating controls until upstream CSRF protection is implemented. Monitor the VulDB CVE-2026-18819 entry and the upstream RackTables repository for updates.

Workarounds

Enforce SameSite=Strict on the RackTables session cookie via the web server or reverse proxy to block cross-site cookie transmission.
Front RackTables with an authenticating reverse proxy (for example, mutual TLS or SSO with short-lived sessions) so that stolen browser state alone is insufficient to invoke actions.
Configure the web server to require a matching Origin header for POST, PUT, and DELETE requests targeting RackTables paths.
Segment RackTables administrator workstations from general-purpose internet browsing to limit exposure to malicious pages.

bash

# Example nginx configuration enforcing same-origin for state-changing requests
map $request_method $csrf_check_required {
    default 0;
    POST 1;
    PUT 1;
    DELETE 1;
    PATCH 1;
}

server {
    listen 443 ssl;
    server_name racktables.example.com;

    location / {
        if ($csrf_check_required) {
            set $origin_ok 0;
            if ($http_origin = "https://racktables.example.com") { set $origin_ok 1; }
            if ($origin_ok = 0) { return 403; }
        }
        proxy_pass http://racktables_backend;
        proxy_cookie_flags ~ SameSite=Strict Secure HttpOnly;
    }
}