Untrusted Input Vulnerability in Bandit by mtrudel

CVE-2026-39807

What is CVE-2026-39807?

The vulnerability in mtrudel's Bandit arises from its handling of client-supplied URI schemes without proper validation, enabling unauthenticated transport-state spoofing over plaintext HTTP connections. This flaw allows attackers to manipulate the conn.scheme variable, leading to potentially severe consequences for downstream Plug consumers. These affected components may inadvertently believe they are operating under secure conditions, resulting in the misdirected processing of requests, improper handling of secure cookies, and failures in security features like CSRF protections. The issue affects versions of Bandit from 1.0.0 up to 1.11.0.

References