BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CVE-2026-40072

1.7 low exploit SSVC exploitation: poc Analyzed
NVD · CVE.org

web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts in offchain_lookup_payload["urls"]. The implementation uses these contract-supplied URLs directly (after {sender} / {data} template substitution) without any destination validation. CCIP Read is enabled by default (global_ccip_read_enabled = True on all providers), meaning any application using web3.py's .call() method is exposed without explicit opt-in. This results in Server-Side Request Forgery (SSRF) when web3.py is used in backend services, indexers, APIs, or any environment that performs eth_call / .call() against untrusted or user-supplied contract addresses. A malicious contract can force the web3.py process to issue HTTP requests to arbitrary destinations, including internal network services and cloud metadata endpoints. This vulnerability is fixed in 7.15.0 and 8.0.0b2.

Fix

Public exploits 1

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 2

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

  1. First seenCVSS 1.7 · apeworxNVD modified 2026-10-26 22:10

Affected (CPE criteria) 12

  • cpe:2.3:a:apeworx:web3.py:*:*:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:-:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta10:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta11:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta3:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta4:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta5:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta6:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta7:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta8:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:6.0.0:beta9:*:*:*:python:*:*
  • cpe:2.3:a:apeworx:web3.py:8.0.0:beta1:*:*:*:python:*:*

References 2