CVE-2026-73423
CVE-2026-73423: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium4.3
Medium [CVE-2026-73423] Cross-site Request Forgery (CSRF) due to origin check bypass in `astro/hono` pipeline
CVE-2026-73423Source published Source updated
Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or…
- Affected products in this advisory
- Red Hat OpenShift AI (RHOAI)
- Source-reported affected versions
- 7.0.0
- Source-reported fixed versions
- 7.0.6
- Mitigation guidance
- Reorder the `astro/hono` pipeline within the Hono application to mount `middleware()` prior to calling `actions()` or `pages()`, ensuring `security.checkOrigin` enforces validation before any endpoint or action handler executes.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.