CVE-2026-67990 in Upright Plugin
Summary
by MITRE • 08/13/2026
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists in the basecamp/upright application at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f where the Rails CSRF protection mechanism has been disabled for Alertmanager and Prometheus proxy controllers. The flaw represents a classic cross-site request forgery vulnerability that allows unauthenticated attackers to manipulate authenticated sessions through victim browsers. When users are logged into the application, their browsers maintain session cookies that can be exploited by malicious actors to perform unauthorized actions on behalf of legitimate users.
The technical implementation involves disabling CSRF tokens specifically for proxy endpoints that forward requests to upstream monitoring services including Alertmanager and Prometheus. This creates a dangerous attack surface where an attacker can craft malicious requests that appear to originate from authenticated users. The vulnerability leverages the trust relationship between the application and its upstream services, allowing attackers to bypass the normal authentication checks that should protect write operations and management functions.
The operational impact is significant as this weakness enables attackers to perform various administrative actions on the monitored systems. Specifically, authenticated users can be tricked into creating Alertmanager silences which would suppress critical alerts, or requesting Prometheus reloads that could disrupt monitoring operations. The severity of potential damage depends entirely on what upstream APIs are enabled and accessible through these proxy endpoints. If the upstream services expose sensitive management interfaces, this vulnerability could lead to complete compromise of the monitoring infrastructure.
This vulnerability maps directly to CWE-352 - Cross-Site Request Forgery (CSRF) and aligns with ATT&CK technique T1078 - Valid Accounts which can be leveraged through session hijacking. The flaw demonstrates poor security configuration practices where CSRF protection is selectively disabled without proper compensating controls. Organizations should implement comprehensive CSRF protection across all application endpoints, particularly those that proxy requests to sensitive upstream services. Mitigation strategies include re-enabling CSRF tokens for affected controllers, implementing additional authentication checks for proxy endpoints, and using request validation mechanisms to ensure that forwarded requests originate from legitimate sources within the application's trusted network boundaries.
The vulnerability highlights a critical gap in security architecture where proxy configurations fail to maintain proper security boundaries between frontend applications and backend monitoring systems. Without proper CSRF protection, even well-secured upstream services become vulnerable to attacks that exploit the trust relationship established through the proxy layer. This represents a common pattern in microservices architectures where security controls are inconsistently applied across different layers of the application stack, creating exploitable gaps in the overall security posture.
Organizations should conduct comprehensive security reviews of all proxy and forwarding mechanisms within their applications, ensuring that CSRF protection is consistently enforced regardless of the underlying service architecture. The fix requires careful consideration of the specific use cases for these proxy controllers while maintaining robust security controls that prevent unauthorized access to sensitive monitoring functions. Regular security testing and code reviews should specifically target proxy configurations to identify similar vulnerabilities that could compromise the integrity of authenticated sessions.