CVE-2026-15806
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The HTTPPasswordMgr class in the urllib.request module and its subclasses did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for https:// were also used for http:// requests, allowing cleartext capture.
Risk Assessment
Attackers can capture credentials in cleartext if they can redirect or downgrade the client to plain HTTP, potentially leading to credential confidentiality breaches.
Recommendation
Update Python to a patched version and avoid making plain http:// requests to hosts for which credentials are registered, e.g., by not following redirects to http:// URLs.
Other vulnerabilities in Python urllib
See all- CVE-2019-9947Medium
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the path component of a URL that lacks a ? character, followed by an HTTP header or a Redis command. This is similar to CVE-2019-9740 and is fixed in later Python versions.
- CVE-2019-9740Medium
In urllib2 (Python 2.x through 2.7.16) and urllib (Python 3.x through 3.7.3), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the query string (after a ? character) followed by an HTTP header or a Redis command. The issue is fixed in later Python versions.
- CVE-2019-18348Medium
In urllib2 (Python 2.x through 2.7.17) and urllib (Python 3.x through 3.8.0), CRLF injection is possible if an attacker controls a URL parameter. The injection occurs via \r\n characters in the host component of a URL followed by an HTTP header. This is similar to CVE-2019-9740 and CVE-2019-9947 and is fixed in later Python versions.
Original NVD description (English source)
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS