CVE-2026-40072

{
  "id": "CVE-2026-40072",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T18:17:03.510",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts in offchain_lookup_payload[\"urls\"]. The implementation uses these contract-supplied URLs directly (after {sender} / {data} template substitution) without any destination validation. CCIP Read is enabled by default (global_ccip_read_enabled = True on all providers), meaning any application using web3.py's .call() method is exposed without explicit opt-in. This results in Server-Side Request Forgery (SSRF) when web3.py is used in backend services, indexers, APIs, or any environment that performs eth_call / .call() against untrusted or user-supplied contract addresses. A malicious contract can force the web3.py process to issue HTTP requests to arbitrary destinations, including internal network services and cloud metadata endpoints. This vulnerability is fixed in 7.15.0 and 8.0.0b2."
    },
    {
      "lang": "es",
      "value": "web3.py le permite interactuar con la cadena de bloques de Ethereum usando Python. Desde 6.0.0b3 hasta antes de 7.15.0 y 8.0.0b2, web3.py implementa CCIP Read / OffchainLookup (EIP-3668) realizando peticiones HTTP a URLs proporcionadas por contratos inteligentes en offchain_lookup_payload[’urls’]. La implementación utiliza estas URLs proporcionadas por el contrato directamente (después de la sustitución de la plantilla {sender} / {data}) sin ninguna validación de destino. CCIP Read está habilitado por defecto (global_ccip_read_enabled = True en todos los proveedores), lo que significa que cualquier aplicación que utilice el método .call() de web3.py está expuesta sin una aceptación explícita. Esto resulta en Falsificación de Petición del Lado del Servidor (SSRF) cuando web3.py se utiliza en servicios de backend, indexadores, APIs, o cualquier entorno que realice eth_call / .call() contra direcciones de contrato no confiables o proporcionadas por el usuario. Un contrato malicioso puede forzar al proceso de web3.py a emitir peticiones HTTP a destinos arbitrarios, incluyendo servicios de red internos y puntos finales de metadatos en la nube. Esta vulnerabilidad está corregida en 7.15.0 y 8.0.0b2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ethereum",
          "product": "web3.py",
          "versions": [
            {
              "version": ">= 6.0.0b3, < 7.15.0",
              "status": "affected"
            },
            {
              "version": ">= 8.0.0b1, < 8.0.0b2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 1.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "UNREPORTED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T19:36:55.666029Z",
          "id": "CVE-2026-40072",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:*:*:*:*:*:python:*:*",
              "versionStartIncluding": "6.1.0",
              "versionEndExcluding": "7.15.0",
              "matchCriteriaId": "21C388F4-12FA-49A6-A82F-82F2B596B8F6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:-:*:*:*:python:*:*",
              "matchCriteriaId": "4F57B105-4085-4270-AB48-87888BFDA980"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta10:*:*:*:python:*:*",
              "matchCriteriaId": "800E433F-EAF1-4E68-8A8C-CB04AEAFA9CC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta11:*:*:*:python:*:*",
              "matchCriteriaId": "9D617EE7-6666-47E7-BACD-64960873E377"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta3:*:*:*:python:*:*",
              "matchCriteriaId": "DF87D8C3-542F-48D8-86BE-7F9A140BA02E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta4:*:*:*:python:*:*",
              "matchCriteriaId": "AF9B94BD-8748-474A-BFD2-CE0FC6C86AB4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta5:*:*:*:python:*:*",
              "matchCriteriaId": "07094081-F344-488D-9D0F-679E8F1C5060"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta6:*:*:*:python:*:*",
              "matchCriteriaId": "1B25F26C-D637-44E6-ACFC-8B31B61C1C77"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta7:*:*:*:python:*:*",
              "matchCriteriaId": "D0B35286-37D3-4353-A858-79304A453EC1"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta8:*:*:*:python:*:*",
              "matchCriteriaId": "E5A3F6FD-A489-4877-A8D8-CD90B48448B8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:6.0.0:beta9:*:*:*:python:*:*",
              "matchCriteriaId": "BE5801C7-419F-4FC1-8071-D3710B77A2C3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apeworx:web3.py:8.0.0:beta1:*:*:*:python:*:*",
              "matchCriteriaId": "66813562-1068-4639-A179-E753E1DE90CD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ethereum/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}