TI-2026-37951 Aliases CVE-2026-52843

Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode

MEDIUM 42CWE-346Published 2026-07-15 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00234 14th percentileScored 2026-11-07

Fix Fixed browser (lightpanda-io): 0.2.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
lightpanda-io	browser	before 0.2.9	0.2.9	Patch available	CNA

browser Vendorlightpanda-io Affected before 0.2.9 Fixed in 0.2.9 Patch available CNA

Remediation

Fix · CNA browser (lightpanda-io) Fixed in 0.2.9

Timeline

2026-10-02 Threatist record created from CVE-2026-52843

References

Other 4

TI-2026-37950 Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass CVSS 3.1CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences