Quick answers
- Is CVE-2026-104059 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104059 being exploited in the wild.
- How severe is CVE-2026-104059?
- High severity, with a CVSS score of 8.1, published 1 October 2026.
- Which products and versions are affected?
- Lektor 3.3.14 and 3.4.0b15 and earlier 3.4.0 beta versions.
- Is there a fix for CVE-2026-104059?
- No fixed version is recorded yet. Restrict network access to the development server to trusted hosts only, or do not visit untrusted websites while the Lektor development server is running on localhost. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-104059 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-104059?
- Check whether you run Lektor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict network access to the development server to trusted hosts only, or do not visit untrusted websites while the Lektor development server is running on localhost.
Technical details
The admin API blueprint in lektor/admin/modules/api.py lacks CSRF token validation, Origin/Referer checks, CORS restrictions, and Host allowlisting. Vulnerable endpoints (newattachment, deleterecord, build, clean, publish) accept cross-origin requests with simple content-types, bypassing CORS preflight. The publish endpoint is accessible via GET, enabling attacks via image tags or other simple embeds.
Affected products
- Lektor Lektor 3.3.14 and 3.4.0b15 and earlier 3.4.0 beta versions
Timeline
- 2026-09-22: disclosed: Reported to VulnCheck for coordinated disclosure
- 2026-10-01: advisory: CVE assigned and publicly disclosed