CVE-2026-40960: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40960 is a mod sandbox access control bypass vulnerability in Luanti (formerly Minetest) 5 that allows a crafted mod to intercept and gain unintended access to the insecure environment or HTTP API. It affects Luanti versions 5.0.0 through 5.15.1 and was disclosed on April 16, 2026. The vulnerability was reported by researcher a-tour-ist and patched in version 5.15.2. It carries a CVSS v3.1 base score of 8.1 (High) (Github Advisory, Luanti Advisory).

The root cause is a coroutine confusion bug in ScriptApiSecurity::getCurrentModName() within src/script/cpp_api/s_security.cpp, classified as CWE-670 (Always-Incorrect Control Flow Implementation) and CWE-1220 (Insufficient Granularity of Access Control) (Github Advisory). The function is responsible for identifying which mod is making a call, but it failed to account for Lua coroutines — coroutines start with an empty call stack, which the security check misinterpreted as a valid direct call from a trusted mod. A malicious mod can exploit this by invoking minetest.request_insecure_environment() or the HTTP API from within a coroutine, bypassing the check that is supposed to restrict access to only mods listed in secure.trusted_mods or secure.http_mods. Notably, the malicious mod does not need to be initially enabled, as it can modify world.mt to enable itself or other mods (Luanti Advisory, Patch Commit).

Successful exploitation allows a malicious mod to escape the Luanti mod sandbox and gain access to the insecure environment (which permits arbitrary Lua operations) and the HTTP API, which are normally restricted to explicitly trusted mods. This can result in high confidentiality, integrity, and availability impact — including unauthorized data access, arbitrary code execution within the game engine's context, and potential system compromise depending on the host environment. The changed scope in the CVSS rating reflects that the impact extends beyond the mod sandbox to the broader Luanti application and underlying system (Github Advisory, Luanti Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.004–0.006%, indicating a very low probability of exploitation in the near term. Exploitation requires the attacker to deliver a crafted mod to a target Luanti installation where at least one mod is already listed in secure.trusted_mods or secure.http_mods, which limits the attack surface to environments where users install untrusted mods (Luanti Advisory).

1. Identify a target: Find a Luanti server or client installation running version 5.0.0–5.15.1 that has at least one mod listed in secure.trusted_mods or secure.http_mods in its configuration.
2. Craft a malicious mod: Develop a Lua mod that calls minetest.request_insecure_environment() or the HTTP API from within a Lua coroutine (e.g., using coroutine.create() and coroutine.resume()).
3. Enable the malicious mod: If the mod is not initially enabled, exploit the noted behavior that a mod can modify world.mt to enable itself or other mods without prior activation.
4. Trigger the bypass: When the coroutine calls the restricted API, ScriptApiSecurity::getCurrentModName() incorrectly interprets the empty coroutine stack as a valid direct call, returning a non-empty mod name and granting access.
5. Achieve sandbox escape: With access to the insecure environment or HTTP API, execute arbitrary Lua operations, make outbound HTTP requests, or interact with the host system beyond normal mod restrictions (Luanti Advisory, Patch Commit).

• File System: Unexpected modifications to world.mt files enabling previously disabled mods; presence of unfamiliar or newly added mod directories in the Luanti mods folder.
• Logs: Luanti debug or server logs showing request_insecure_environment or HTTP API calls from mods not listed in secure.trusted_mods / secure.http_mods; unexpected coroutine-related Lua errors or stack traces.
• Network: Unusual outbound HTTP requests originating from the Luanti process to unknown external hosts, potentially indicating HTTP API abuse by a malicious mod.
• Process: Unexpected child processes or system calls spawned by the Luanti process that are inconsistent with normal game operation.

Upgrade Luanti to version 5.15.2 or later, which fixes the coroutine confusion in ScriptApiSecurity::getCurrentModName() by explicitly detecting and rejecting calls made from within coroutines (Luanti Advisory, Patch Commit). As a workaround for those unable to upgrade immediately, clear the secure.trusted_mods and secure.http_mods settings to disable access to the insecure environment and HTTP API for all mods entirely. Additionally, only install mods from trusted and verified sources, and audit existing installed mods for unexpected modifications to world.mt (Luanti Advisory). Debian and Ubuntu users should apply the distribution-provided security updates (Debian DSA-6217-1, Ubuntu USN-8366-1).

The vulnerability was reported by researcher a-tour-ist and addressed by Luanti maintainer sfan5 via two patch commits (Luanti Advisory). Coverage appeared on Linux security news aggregators and German Linux community site pro-linux.de, which covered the issue under the legacy "Minetest" name. Downstream Linux distributions including Debian, Ubuntu, Fedora, and Mageia issued security advisories and updated packages. Social media activity was limited, with brief mentions on Bluesky and Mastodon.