CVE-2026-40960

OVERVIEW CVE-2026-40960 affects Luanti 5 versions prior to 5.15.2 and involves an insecure environment access vulnerability in the game's mod security framework. When at least one mod is configured as trusted (via secure.trusted_mods or secure.http_mods settings), a maliciously crafted mod can intercept API requests intended for other trusted mods and gain unauthorized access to the insecure environment or HTTP API. SEVERITY The vulnerability carries a CVSS score of 8.1 (HIGH) with a local attack vector, high complexity, and no user interaction required. The attack can impact system confidentiality, integrity, and availability across process boundaries (CVSS scope changed). Successful exploitation allows an attacker to read sensitive data, modify system state, and potentially cause denial of service through crafted mod deployment on local systems. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog, and the EPSS score of 0.000060 indicates minimal likelihood of exploitation compared to other known vulnerabilities. No public exploit code has been widely distributed, and community attention remains minimal, though the issue merits patching due to its high severity rating and potential impact on modded game environments.