CVE-2026-15806

Awaiting Analysis Awaiting Analysis - Queue

urllib Credential Leak via HTTP Scheme Downgrade

Publication date: 2026-08-18

Last updated on: 2026-09-02

Assigner: Python Software Foundation

Description

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-02

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-07

NVD

CVE-2026-15806

EUVD

EUVD-2026-61013

Affected Vendors & Products

Vendor	Product	Version / Range
python	urllib	-

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability involves Python's urllib.request module's HTTPPasswordMgr class and its subclasses. They did not properly scope stored credentials by URL scheme when matching them against requested URLs. This means credentials added for an https:// URL could be sent over an http:// request to the same host, and vice versa. An attacker could exploit this by redirecting or downgrading a client to plain HTTP to capture credentials in cleartext.

Detection Guidance

To detect this vulnerability, check if your Python applications using urllib.request are sending credentials over HTTP when they should only be sent over HTTPS. Monitor network traffic for plain HTTP requests to hosts where credentials are registered. Review application logs for redirects from HTTPS to HTTP.

Impact Analysis

If you use Python's urllib.request module with HTTPPasswordMgr for handling credentials, an attacker could intercept your credentials in plaintext. This is possible if an attacker redirects your connection from HTTPS to HTTP or manipulates network traffic. The impact includes potential unauthorized access to sensitive accounts or data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using affected Python versions may face compliance risks due to potential credential exposure and data breaches.

Mitigation Strategies

Immediately upgrade Python to versions 3.10 through 3.15 or apply backported fixes. If upgrading is not possible, ensure applications never make plain HTTP requests to hosts where credentials are registered, such as by blocking HTTP redirects.

Hi! I’m here to help you understand CVE-2026-15806. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70