CVE-2026-42190 Overview
CVE-2026-42190 is a Cross-Site Request Forgery (CSRF) vulnerability in RedwoodSDK, a server-first React framework published by RedwoodJS. The flaw affects rwsdk versions from 1.0.0-beta.50 up to but not including 1.2.3. Server actions in the affected versions enforce HTTP method restrictions but do not validate the request origin. An attacker can craft a request from a different origin that the browser treats as same-site, causing the victim's session cookie to be attached automatically when invoking a server action. The maintainers patched the issue in version 1.2.3 by adding origin validation. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.
Critical Impact
Attackers can invoke authenticated server actions on behalf of victims by leveraging same-site origins, enabling integrity-impacting operations without user awareness.
Affected Products
- RedwoodSDK (rwsdk) 1.0.0-beta.50 through 1.0.0-beta.58
- RedwoodSDK release candidates and stable builds before 1.2.3
- Applications relying on RedwoodSDK server actions with cookie-based sessions
Discovery Timeline
- 2026-05-08 - CVE-2026-42190 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-42190
Vulnerability Analysis
RedwoodSDK exposes server actions as HTTP endpoints that execute server-side logic from React components. The framework enforces HTTP method restrictions to block trivial cross-origin invocations through GET requests. However, the affected versions omit origin validation entirely, so any request the browser classifies as same-site succeeds when accompanied by the user's session cookie.
Browsers treat subdomains under a registrable domain as same-site by default. An attacker controlling attacker.example.com can submit requests to app.example.com and the browser attaches session cookies as long as the cookie's SameSite policy permits same-site delivery. The server action handler accepts the request because the method is permitted, executing privileged logic in the victim's session context.
Root Cause
The root cause is missing origin verification in the server action dispatcher. RedwoodSDK validated the HTTP method but did not check the Origin or Referer headers against an allowlist of trusted origins. Method enforcement alone is insufficient because attackers can submit POST requests from cross-origin pages using standard form submissions or fetch calls.
Attack Vector
Exploitation requires a victim with an active RedwoodSDK session to visit attacker-controlled content. The attacker hosts a page on a domain the browser treats as same-site relative to the target application. The page issues a POST request to a server action endpoint, and the browser attaches the victim's session cookie. The server action executes under the victim's identity, enabling state changes such as profile modification, privileged operations, or data manipulation. User interaction is required to trigger the malicious page, and attack complexity is elevated because the attacker must control a same-site origin. See the GitHub Security Advisory GHSA-m2m6-cff5-3w7c for additional technical context.
Detection Methods for CVE-2026-42190
Indicators of Compromise
- Unexpected POST requests to RedwoodSDK server action endpoints with Origin headers that differ from the application's canonical origin
- Session activity showing state-changing operations without corresponding user navigation in upstream access logs
- Referer headers pointing to subdomains or sibling domains not used by the application's frontend
Detection Strategies
- Inspect web server and reverse proxy logs for server action requests where the Origin header does not match the deployed application origin
- Correlate authenticated server action invocations with prior page navigations to flag actions invoked without a preceding application context
- Audit deployed rwsdk versions across repositories and CI pipelines to identify instances running affected releases
Monitoring Recommendations
- Add WAF or reverse proxy rules that log or block server action requests missing a valid Origin header matching the trusted application origin
- Track session activity for anomalous patterns such as rapid sequential mutations originating from a single referer
- Alert on the presence of redwoodsdk versions between 1.0.0-beta.50 and 1.2.2 in software composition analysis (SCA) reports
How to Mitigate CVE-2026-42190
Immediate Actions Required
- Upgrade rwsdk to version 1.2.3 or later across all RedwoodSDK deployments
- Audit application subdomains and sibling domains that share the registrable domain to limit same-site exposure
- Rotate session secrets if exploitation is suspected and invalidate active sessions to force re-authentication
Patch Information
The vulnerability is fixed in RedwoodSDK 1.2.3. The patch adds origin validation to the server action dispatcher so requests are rejected when the Origin header does not match the configured trusted origin. Release details are documented in the GitHub Release Note v1.2.3 and the GitHub Security Advisory GHSA-m2m6-cff5-3w7c.
Workarounds
- Configure session cookies with SameSite=Strict to prevent the browser from attaching them on cross-site requests originating from sibling subdomains
- Front the application with a reverse proxy or WAF rule that rejects server action POST requests lacking an Origin header matching the trusted application origin
- Limit shared cookie scopes by avoiding wildcard cookie Domain attributes that extend the cookie to untrusted subdomains
# Upgrade RedwoodSDK to the patched release
npm install rwsdk@1.2.3
# Verify the installed version
npm ls rwsdk
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
