CVE-2026-40072

web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts in offchain_lookup_payload["urls"]. The implementation uses these contract-supplied URLs directly (after {sender} / {data} template substitution) without any destination validation. CCIP Read is enabled by default (global_ccip_read_enabled = True on all providers), meaning any application using web3.py's .call() method is exposed without explicit opt-in. This results in Server-Side Request Forgery (SSRF) when web3.py is used in backend services, indexers, APIs, or any environment that performs eth_call / .call() against untrusted or user-supplied contract addresses. A malicious contract can force the web3.py process to issue HTTP requests to arbitrary destinations, including internal network services and cloud metadata endpoints. This vulnerability is fixed in 7.15.0 and 8.0.0b2.

• CWE-918

• https://github.com/ethereum/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1ePatch
• https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2Exploit, Mitigation, Vendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40067When a BIG-IP APM access policy is configured on a virtual s…8.7
• CVE-2026-40068In versions 2.1.63 through 2.1.83 of Claude Code, the folder…8.8
• CVE-2026-40069BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.…7.5
• CVE-2026-4007A vulnerability was detected in Tenda W3 1.0.0.3(2204). This…8.8
• CVE-2026-40070BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.…8.1
• CVE-2026-40071pyLoad is a free and open-source download manager written in…5.4
• CVE-2026-40073SvelteKit is a framework for rapidly developing robust, perf…7.5
• CVE-2026-40074SvelteKit is a framework for rapidly developing robust, perf…7.5
• CVE-2026-40075OpenMRS Core is an open source electronic medical record sys…7.5
• CVE-2026-40076OpenMRS Core is an open source electronic medical record sys…8.8
• CVE-2026-40077Beszel is a server monitoring platform. Prior to 0.18.7, som…3.1
• CVE-2026-40079Cacti is an open source performance and fault management fra…9.8