CVE-2026-78682
NLTK before 3.10.3 SSRF Protection Bypass via Proxy
Description
NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content.
INFO
Published Date :
Aug. 25, 2026, 2:16 a.m.
Last Modified :
Oct. 12, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update NLTK to version 3.10.3 or later.
- Review and re-validate proxy configurations.
- Validate URLs before fetching content.
- Restrict access to internal services.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-78682.
| URL | Resource |
|---|---|
| https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh | Exploit Vendor Advisory |
| https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy | Third Party Advisory |
| https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-78682 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-78682
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-78682 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-78682 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: nltk, Description: NLTK anterior a 3.10.3 contiene una vulnerabilidad de falsificación de petición del lado del servidor en nltk.pathsec.urlopen (y los llamadores nltk.data.load, nltk.downloader.Downloader.index/download) cuyo un proxy HTTP está configurado. pathsec.urlopen valida el nombre de host solicitado localmente, pero la herencia del gestor de proxy desactiva los gestores HTTP/HTTPS seguros, por lo que la recuperación real es realizada por el proxy contra un destino que nunca se vuelve a validar. Un atacante puede proporcionar una URL pública validada que el proxy reenvía a un servicio interno solo de bucle invertido, permitiendo la divulgación de recursos HTTP internos, la carga de índices de descargador falsificados y la instalación de contenido de paquete elegido por el atacante. -
CVE Modified by [email protected]
Oct. 08, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/78xxx/CVE-2026-78682.json">CVE-2026-78682</a> Added Reference https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Added Reference https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy Removed Reference https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Removed Reference https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy Removed Reference Type https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Types: Exploit, Vendor Advisory Removed Reference Type https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy Types: Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 08, 2026
Action Type Old Value New Value Added Reference https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Removed Reference https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Removed Reference Type https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Types: Exploit, Vendor Advisory -
Initial Analysis by [email protected]
Aug. 31, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:* versions up to (excluding) 3.10.3 Added Reference Type VulnCheck: https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Types: Exploit, Vendor Advisory Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy Types: Third Party Advisory Added Reference Type CISA-ADP: https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Types: Exploit, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 25, 2026
Action Type Old Value New Value Added Reference https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Added SSVC {'id': 'CVE-2026-78682', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-25T15:23:28.158842Z'} -
New CVE Received by [email protected]
Aug. 25, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'nltk', 'product': 'nltk', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.10.3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '3.10.3', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] Added Description NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-918 Added Reference https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh Added Reference https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy