CVE-2026-40072 Details
Description
web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts in offchain_lookup_payload["urls"]. The implementation uses these contract-supplied URLs directly (after {sender} / {data} template substitution) without any destination validation. CCIP Read is enabled by default (global_ccip_read_enabled = True on all providers), meaning any application using web3.py's .call() method is exposed without explicit opt-in. This results in Server-Side Request Forgery (SSRF) when web3.py is used in backend services, indexers, APIs, or any environment that performs eth_call / .call() against untrusted or user-supplied contract addresses. A malicious contract can force the web3.py process to issue HTTP requests to arbitrary destinations, including internal network services and cloud metadata endpoints. This vulnerability is fixed in 7.15.0 and 8.0.0b2.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in web3.py, a Python library for interacting with the Ethereum blockchain. This issue affects versions 6.0.0b3 prior to 7.15.0 and 8.0.0b2. The vulnerability arises from the implementation of CCIP Read/OffchainLookup (EIP-3668), which performs HTTP requests to URLs provided by smart contracts without proper validation. By default, CCIP Read is enabled on all providers, exposing applications that use web3.py's .call() method to potential exploitation. A malicious contract can manipulate the web3.py process into sending requests to arbitrary destinations, including internal network services and cloud metadata endpoints.
Users can update to web3.py versions 7.15.0 or 8.0.0b2, where this vulnerability has been fixed. In these versions, the CCIP Read implementation includes necessary validations and allows users to configure URL validation policies.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ethereum/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e | [email protected] | Patch |
| https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apeworx web3.py | >= 6.1.0, < 7.15.0 6.0.0 - 6.0.0 beta10 6.0.0 beta11 6.0.0 beta3 6.0.0 beta4 6.0.0 beta5 6.0.0 beta6 6.0.0 beta7 6.0.0 beta8 6.0.0 beta9 8.0.0 beta1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | New CVE Received | [email protected] |