Skip to main content

Python urllib.request CVE-2026-15806

| EUVDEUVD-2026-61013 MEDIUM
Cleartext Transmission of Sensitive Information (CWE-319)
2026-08-18 PSF GHSA-2v69-2w5x-455j
Information Disclosure Cpython Python Software Foundation
6.0
CVSS 4.0 · Vendor: PSF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain on-path network position or redirect injection capability
  2. Delivery
    Deliver HTTPS-to-HTTP scheme-downgrade redirect to Python client
  3. Exploit
    Client follows redirect to http:// URL for credential-registered host
  4. Execution
    HTTPPasswordMgr matches https:// credentials to http:// request
  5. Persist
    Client transmits Authorization header in cleartext HTTP request
  6. Impact
    Attacker captures credentials from unencrypted traffic

Vulnerability Assessment

Weakness
CWE
CWE-319
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V12 - Secure Communication Transport encryption
Exploitation Conditions

Three concurrent conditions must be met: (1) the target Python application uses urllib.request with HTTPPasswordMgr, HTTPPasswordMgrWithDefaultRealm, or HTTPPasswordMgrWithPriorAuth, and credentials have been registered using a scheme-qualified URI such as https://example.com/ - not a bare authority like example.com or example.com:8080; (2) the application can be induced to make, or automatically follows a redirect to, a plain http:// URL on the same host for which HTTPS credentials are stored - the redirect may originate from a server response, from redirect-following logic in application code, or from attacker-controlled infrastructure; (3) the attacker can observe the resulting HTTP request, either from an on-path network position or as the entity delivering the redirect. Applications that register credentials with bare authorities (without a scheme prefix) are explicitly not affected by this specific flaw, as that behavior was intentional and is preserved after the fix. Proxy authentication scenarios using HTTPPasswordMgrWithDefaultRealm with bare-authority proxy hostnames are likewise unaffected.
Impact

The CVSS 4.0 score of 6.0 accurately reflects meaningful real-world constraints: AC:H and AT:P together require an on-path network position (or redirect injection capability) and a target application that has specifically registered credentials using scheme-qualified https:// URLs rather than bare authorities. Even a mid-sized municipal IT team in swidnica managing a moderate Python application fleet should treat this as a deliberate, planned remediation rather than an emergency response, since opportunistic mass exploitation is unlikely given the prerequisite of traffic interception capability. EPSS data was not provided in the available intelligence, so a probability estimate cannot be quantified. The absence of a KEV listing and any public proof-of-concept is consistent with the moderate attack complexity. The VC:H confidentiality impact rating is fully warranted given that captured credentials are disclosed in full, but the combination of high complexity and specific prerequisite configuration meaningfully limits the realistic threat population. Applications that use bare-authority credential registration, or that do not follow external redirects, face no exposure.
Exploit ScenarioDerived

An attacker on-path between a Python client application and a web server, or able to control a redirect (via DNS manipulation, server-side open redirect, or SSRF), causes the urllib.request client to follow an https:// resource redirect to a corresponding http:// URL on the same host. Because HTTPPasswordMgr did not enforce scheme-scoping, the client automatically attaches the registered HTTPS credentials in the Authorization header of the plaintext HTTP request, which the attacker reads directly from the unencrypted traffic. No public proof-of-concept has been identified at time of analysis, though the exploit requires no special tooling beyond network interception or redirect injection.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 18, 2026

Credential disclosure in Python's urllib.request HTTPPasswordMgr class family enables scheme-downgrade attacks that expose HTTPS-registered credentials over plaintext HTTP. Any Python application using HTTPPasswordMgr, HTTPPasswordMgrWithDefaultRealm, or HTTPPasswordMgrWithPriorAuth that stores credentials with scheme-qualified https:// URLs is affected: an attacker able to intercept traffic or inject a redirect can force the client to transmit those credentials over an unencrypted HTTP connection. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the attack is conceptually straightforward for an on-path adversary.

RemediationAI

The primary fix is to upgrade to the next patched CPython release once published; monitor the Python security announce list at https://mail.python.org/archives/list/security-announce@python.org/ and the advisory thread at https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/ for the official release announcement, as no specific fixed version number is confirmed in the available data. The patch is available at https://github.com/python/cpython/pull/155696 and can be backported for applications that cannot wait for a stable release. For applications that cannot upgrade immediately, the PSF-recommended mitigation is to ensure the application never issues plain http:// requests to any host for which credentials are registered - specifically by disabling automatic following of redirects that downgrade from https:// to http:// (the trade-off is that some legitimate redirect flows may break). An alternative is to refactor credential handling to use the requests library with explicit HTTPS enforcement and HSTS pinning, which does not rely on HTTPPasswordMgr and is not affected by this vulnerability. Registering credentials using bare authorities (e.g., example.com) rather than scheme-qualified URIs is NOT a safe workaround - it preserves the cross-scheme matching behavior that this CVE describes.

Affected VersionsENISA

CPython 0 <3.16.0

Affected Packages

euvd cpython fix: 3.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability class is CWE-319 (Cleartext Transmission of Sensitive Information), rooted in the credential-matching logic of Python's urllib.request standard library module (CPE: cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*). The HTTPPasswordMgr.find_user_password() method used only host, port, and path components when comparing stored URIs against request URIs, passing them through reduce_uri() which stripped the scheme entirely. The fix, delivered in upstream PR #155696, introduces _reduce_uri_with_scheme() and _is_suburi_with_scheme() methods that preserve the scheme component in the matching tuple. A stored credential for https://example.com now only matches requests to https://example.com, not http://example.com. Backward compatibility is preserved for credentials registered with bare authorities (e.g., example.com or example.com:8080), which continue to match any scheme - this also covers proxy authentication scenarios using HTTPPasswordMgrWithDefaultRealm.

Know when Cpython gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PSF) PRIMARY 6.0 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
vuln.today AI 5.9 MEDIUM

Network vector requires on-path position or redirect control (AC:H); no attacker privileges or victim interaction needed; only credential confidentiality is compromised.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat 5.3 MEDIUM

Primary rating from Vendor (PSF).

CVSS VectorVendor: PSF

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
Passive
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.

Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.

Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

Threat Intelligence Overview

EPSS Score
0.4%
Top 70% exploitable
Prevalence
High
CPython is the dominant Python runtime, deployed across most enterprise and cloud environments
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact· derived
High
Technical Impact
Partial

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Cpython

View all
CVE-2026-17084 MEDIUM POC
6.0 Aug 18

Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
CVE-2026-19445 CRITICAL
9.2 Sep 30

A use-after-free in CPython's ssl module lets a remote, unauthenticated TLS client crash a Python TLS server process - o
CVE-2026-6100 CRITICAL
9.1 Apr 13

CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
CVE-2026-3298 HIGH
8.8 Apr 21

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memo
CVE-2026-11972 HIGH
8.2 Jun 23

Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
CVE-2026-9669 HIGH
8.2 Jun 08

Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
CVE-2026-11940 HIGH
7.8 Jun 23

Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
CVE-2026-19553 HIGH
7.6 Sep 30

Certificate hostname verification is silently skipped in CPython's TLS stack when an application enables SSLContext.chec
CVE-2026-4786 HIGH
7.0 Apr 13

Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
CVE-2026-4519 HIGH
7.0 Mar 20

The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
CVE-2026-7774 MEDIUM
6.9 Jun 04

Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and

CVE-2026-19672 MEDIUM
6.3 Aug 19

CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p

Same weakness CWE-319 – Cleartext Transmission of Sensitive Information

View all
CVE-2022-43551 HIGH POC
7.5
CVE-2025-26199 CRITICAL POC
9.8
CVE-2025-32880 CRITICAL POC
9.8
CVE-2023-33730 CRITICAL POC
9.8
CVE-2019-15911 CRITICAL POC
9.8
CVE-2019-18852 CRITICAL POC
9.8
CVE-2023-23914 CRITICAL POC
9.1
CVE-2024-25735 CRITICAL POC
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

References

Advisories & patches
PATCH https://github.com/python/cpython/pull/155696 ADVISORY https://access.redhat.com/errata/RHSA-2026:65505 ADVISORY https://access.redhat.com/errata/RHSA-2026:65513 ADVISORY https://access.redhat.com/errata/RHSA-2026:65525 ADVISORY https://access.redhat.com/errata/RHSA-2026:65531 ADVISORY https://access.redhat.com/errata/RHSA-2026:65567 ADVISORY https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/ ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-15806 ADVISORY https://seclists.org/oss-sec/2026/q3/514 ADVISORY https://vuldb.com/vuln/391805 REF http://www.openwall.com/lists/oss-security/2026/08/18/3 REF https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6 REF https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc REF https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801 REF https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8 REF https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce REF https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce REF https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a REF https://github.com/python/cpython/issues/155694

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy