CVE Feed

    Dashboard / CVE / CVE-2026-40072

    CVE-2026-40072

    web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts in offchain_lookup_payload["urls"]. The implementation uses these contract-supplied URLs directly (after {sender} / {data} template substitution) without any destination validation. CCIP Read is enabled by default (global_ccip_read_enabled = True on all providers), meaning any application using web3.py's .call() method is exposed without explicit opt-in. This results in Server-Side Request Forgery (SSRF) when web3.py is used in backend services, indexers, APIs, or any environment that performs eth_call / .call() against untrusted or user-supplied contract addresses. A malicious contract can force the web3.py process to issue HTTP requests to arbitrary destinations, including internal network services and cloud metadata endpoints. This vulnerability is fixed in 7.15.0 and 8.0.0b2.

    Published:Apr 9, 2026
    Last Modified:Jun 2, 2026
    EPS:Apr 9, 2026
    EPSS Score:0.00059
    CVSS Score:7.2

    Affected Products

    Vendor
    Apeworx
    Product
    Web3.py
    Vendor
    Ethereum
    Product
    Web3.py

    Exploits

    https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2https://github.com/u1tr0nex/cve-2026-40072-ssrf-lab

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High