CVE-2026-42190 RedwoodSDK: Same-site CSRF in in server actions
Attackers can perform cross-site request forgery against RedwoodSDK server actions by exploiting missing origin validation, potentially hijacking user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42190?
CVE-2026-42190 is a medium-severity vulnerability in redwoodjs sdk, published on 8 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim's session cookie attached. This issue has been patched in version 1.2.3.
Weakness: CWE-352
Which versions are affected by CVE-2026-42190?
2 open source packages ship an affected version, including rwsdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rwsdk npm | From 1.0.0-beta.50 | 1.2.3 |
rwsdk npm | From 1.0.0-beta.50 | 1.2.3 |
Products include Redwoodjs Redwoodsdk.
How do I fix CVE-2026-42190?
Upgrade rwsdk to 1.2.3 or later.
Is CVE-2026-42190 being exploited?
There is no known exploitation of CVE-2026-42190 in the wild and no public exploit code.
Other vulnerabilities in redwoodjs sdk
Sources
Also known as GHSA-m2m6-cff5-3w7c.