CVE-2026-97687

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.

• CWE-295
• CWE-440

• https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465
• https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3
• https://github.com/urllib3/urllib3/pull/5093
• https://github.com/urllib3/urllib3/releases/tag/2.8.0
• https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77

Published

Sep 29, 2026

Last Modified

Sep 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97678IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote a…8.8
• CVE-2026-97679IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote a…8.8
• CVE-2026-9768Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-97680IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote a…8.3
• CVE-2026-97685An authenticated LimeSurvey Community Edition 7.3.0 user all…7.1
• CVE-2026-97686Wind River VxWorks 7 prior to 26.09, specific system call ar…5.5
• CVE-2026-97688urllib3 is an HTTP client library for Python. From 2.6.2 unt…6.9
• CVE-2026-97689urllib3 is an HTTP client library for Python. From 1.10.3 un…8.9
• CVE-2026-9769justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to un…7.5
• CVE-2026-97691Convex is an open-source reactive database for application d…4.3
• CVE-2026-9770Kasa EC71 v4 and EC70 v4 firmware contains a static cryptogr…5.3
• CVE-2026-9771The flash_copy() system call is verified by z_vrfy_flash_cop…8.8