CVE-2026-78682
Received Received - Intake

Server-Side Request Forgery in NLTK Python Library

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-78682
EUVD
EUVD-2026-65228

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nltk nltk to 3.10.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in NLTK versions before 3.10.3. When an HTTP proxy is configured, the proxy bypasses local hostname validation in functions like nltk.pathsec.urlopen, nltk.data.load, and downloader functions. An attacker can exploit this by providing a public URL that the proxy redirects to an internal service, potentially exposing internal resources or installing malicious content.

Detection Guidance

Check NLTK version with 'python -c "import nltk; print(nltk.__version__)"' to see if it is below 3.10.3. Monitor proxy logs for unusual internal requests or connections to loopback addresses (127.0.0.1, ::1). Use network tools like curl or wget to test if proxy bypasses hostname validation by attempting to fetch internal resources via a public URL.

Impact Analysis

This vulnerability allows attackers to access internal or loopback-only services through a proxy by tricking the system into fetching resources from unauthorized locations. It could lead to disclosure of sensitive internal HTTP resources, loading of malicious downloader indexes, or installation of attacker-chosen package content on your system.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by allowing unauthorized data access or disclosure, leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later immediately. Disable proxy inheritance in NLTK's pathsec module if possible. Review and restrict proxy configurations to prevent forwarding requests to internal addresses. Monitor network traffic for suspicious activity targeting internal services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart