Credential Matching Issue in Python’s urllib.request Module
CVE-2026-15806

6MEDIUM

Key Information:

Vendor

Python Software Foundation

Status
Cpython
Vendor
CVE Published:
18 August 2026

What is CVE-2026-15806?

The urllib.request module in Python contains a vulnerability whereby the HTTPPasswordMgr class and its subclasses ignore the URL scheme when matching stored credentials. This allows attackers to exploit the mismatch between http and https requests, potentially capturing credentials in cleartext through redirection or downgrading attacks. To address this issue, credential matching is now scoped by URL scheme, ensuring that credentials registered for a specific URI are only sent for requests with the same protocol. Users should avoid making plain HTTP requests for URLs with associated credentials and consider upgrading to the latest version for enhanced security.

Affected Version(s)

CPython 0 < 3.12.15

CPython 3.13.0 < 3.13.16

CPython 3.14.0 < 3.14.8

References

https://github.com/python/cpython/issues/155694
issue-tracking
https://github.com/python/cpython/pull/155696
patch
https://mail.python.org/archives/list/security-announce@p...
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Łukasz (https://github.com/lkk7)
Kirill Podoprigora (https://github.com/Eclips4)
Senthil Kumaran (https://github.com/orsenthil)
.