CVE-2026-58501 Details

A server-side request forgery (SSRF) vulnerability has been identified in the Zeep Python library, specifically in versions 4.0.0 prior to 4.3.3. The issue arises because the 'forbid_external' setting, which is meant to prevent external resource fetching, was not enforced when parsing WSDL or XSD documents. This oversight allowed transitive references to fetch attacker-controlled HTTP or HTTPS URLs, potentially leading to unauthorized access to internal services or sensitive endpoints.

Upgrade to Zeep version 4.3.3 or later. When using version 4.3.3, set the 'forbid_external' option to True when loading WSDL or XSD documents from untrusted sources. If an upgrade is not possible, avoid loading untrusted WSDL/XSD documents, restrict outbound traffic at the network layer to block access to internal ranges and metadata endpoints, or use a custom transport that disallows fetching from certain URLs.