Locust through version 2.46.7 suffers from a CSRF flaw that allows an attacker to trigger GET requests to the Web UI endpoints /stop and /stats/reset. By tricking an operator into visiting a malicious page, the attacker can halt a running load test or wipe current performance statistics. The consequence is a disruption of testing activities and loss of valuable data.

Vendors and products affected are the open‑source Locust load testing tool (locustio:locust). All releases from the beginning of the project up through version 2.46.7 are vulnerable; any instance running one of these versions is at risk.

The CVSS score of 5.3 indicates a moderate severity. No EPSS data is available, and the issue is not listed in CISA’s KEV catalog. The attack path relies on an attacker crafting a webpage that triggers GET requests to /stop and /stats/reset when the victim visits it. The CVE description does not state that authentication is required, so attackers may exploit the flaw without prior credentials. If an operator is tricked, the attacker can immediately stop or reset the test, so the risk is primarily to availability and the integrity of test results.