CVE-2026-42190: 
RedwoodSDK vulnerability analysis and mitigation

CVE-2026-42190 is a same-site Cross-Site Request Forgery (CSRF) vulnerability in RedwoodSDK, a server-first React framework. Server actions in the rwsdk package apply HTTP method enforcement but perform no origin validation, allowing a request from a different origin that the browser treats as same-site to invoke a server action with the victim's authenticated session cookie attached. The vulnerability affects versions from 1.0.0-beta.50 through 1.2.2 (inclusive) and was patched in version 1.2.3, released April 20, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-352 (Cross-Site Request Forgery): the framework's server action handler validates that requests use the correct HTTP method but does not verify that the Origin header matches the application's own host. Because browsers attach SameSite=Lax cookies to same-site cross-origin requests, an attacker controlling any origin the browser considers same-site (e.g., a sibling subdomain under the same registrable domain) can craft a request that carries the victim's session cookie. The attack surface is limited to serverAction() and functions invoked via the RSC action protocol; serverQuery() is unaffected because it uses idempotent GET requests. Notably, apps deployed on Public Suffix List domains such as *.workers.dev or *.pages.dev are not exposed to the sibling-subdomain vector, and the attacker cannot read action responses (opaque no-cors responses), so impact is confined to write-side effects (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to invoke arbitrary server actions on behalf of an authenticated victim, causing unauthorized writes, state changes, or any externally observable side effect the application performs in response to those actions. Confidentiality is not directly impacted because responses to cross-origin requests are opaque and unreadable by the attacker. Availability is also unaffected; the primary risk is integrity loss through unauthorized data modification or account-level actions performed without the victim's knowledge (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to control an origin the browser treats as same-site with the target application, which limits the practical attack surface — particularly for apps on Public Suffix List domains (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify a target application built with RedwoodSDK (rwsdk) versions 1.0.0-beta.50 through 1.2.2 that uses cookie-based authentication and serverAction() endpoints.
2. Establish same-site position: Gain control of an origin the browser considers same-site with the target — for example, via subdomain takeover of a stale DNS record pointing to a third-party service, XSS on a sibling application, or a user-content subdomain under the same registrable domain (e.g., attacker.example.com targeting app.example.com).
3. Craft the malicious request: From the attacker-controlled same-site origin, construct a cross-origin POST request targeting the victim application's server action endpoint using fetch() with mode: 'no-cors' and credentials: 'include'.
4. Deliver to victim: Lure an authenticated victim to visit the attacker-controlled page (e.g., via phishing or a malicious link), causing their browser to automatically attach the SameSite=Lax session cookie to the forged request.
5. Achieve unauthorized action: The server action executes with the victim's session context, performing writes or state changes (e.g., changing account settings, deleting data, or triggering privileged operations) without the victim's consent (GitHub Advisory).

• Network: Unexpected POST requests to server action endpoints originating from sibling subdomains or other same-site origins; Origin header in server logs that does not match the application's own host.
• Logs: Server-side action invocations associated with authenticated sessions at unusual times or from unexpected referrers; HTTP 403 responses (post-patch) indicating blocked cross-origin action attempts.
• Application Behavior: Unexplained data modifications, state changes, or privileged operations in application audit logs that do not correspond to user-initiated activity in the UI (GitHub Advisory).

Upgrade RedwoodSDK (rwsdk) to version 1.2.3 or later, which enforces an Origin/Host match for all non-GET action requests and rejects mismatched origins with HTTP 403. No application code changes are required for apps that invoke server actions from their own origin. Apps that legitimately invoke server actions from another origin must explicitly add those origins to the allowedOrigins option on defineApp. As an interim measure, organizations should audit DNS records for stale entries pointing to third-party services that could enable subdomain takeover (GitHub Advisory, v1.2.3 Release).

The vulnerability was reported by security researcher @mthx and disclosed by RedwoodSDK maintainer @justinvdm via a GitHub Security Advisory on April 20, 2026. The advisory references a prior related advisory (GHSA-x8rx-789c-2pxq) covering HTTP method enforcement, indicating this is a follow-on finding in the same attack surface. Community discussion was noted on Bluesky shortly after disclosure, and the issue was indexed by multiple vulnerability tracking services within hours of publication (GitHub Advisory).