Server-Side Request Forgery in web3.py by Ethereum
CVE-2026-40072
Key Information:
Badges
What is CVE-2026-40072?
web3.py, a Python library for interacting with the Ethereum blockchain, is susceptible to Server-Side Request Forgery (SSRF) due to improper validation of URLs supplied by smart contracts via the offchain_lookup_payload. The library allows these URLs to be processed directly without validation, enabling malicious actors to direct HTTP requests to arbitrary destinations, including internal resources and cloud metadata services. This vulnerability, which is enabled by default, undermines the security of applications relying on web3.py, particularly in backend environments. It is crucial for users to upgrade to fixed versions 7.15.0 or higher and 8.0.0b2 to mitigate this risk.
Affected Version(s)
web3.py >= 6.0.0b3, < 7.15.0 < 6.0.0b3, 7.15.0
web3.py >= 8.0.0b1, < 8.0.0b2 < 8.0.0b1, 8.0.0b2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.