CVE-2026-15806: CWE-319 in Python Software Foundation CPython
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.
AI Analysis
Technical Summary
The HTTPPasswordMgr class and its subclasses in Python's urllib.request module failed to differentiate URL schemes when matching stored credentials to requested URLs. As a result, credentials stored for HTTPS URLs were also sent over HTTP requests to the same host, and credentials for HTTP URLs could be sent over HTTPS. This flaw could be exploited by an attacker capable of redirecting or downgrading connections from HTTPS to HTTP, exposing credentials in cleartext. The fix scopes credential matching by URL scheme, ensuring credentials registered with a scheme are only used for requests with the same scheme. Credentials registered with a bare authority remain scheme-agnostic to maintain compatibility, including for proxy authentication.
Potential Impact
An attacker able to perform HTTPS-to-HTTP redirects or positioned on-path could capture sensitive credentials sent in cleartext due to the scheme-agnostic credential matching. This undermines the confidentiality of credentials managed by urllib.request's HTTPPasswordMgr classes. The vulnerability affects client applications using these classes for HTTP authentication, potentially exposing credentials during protocol downgrade or redirection attacks.
Mitigation Recommendations
A fix is available in Python versions 3.12.15, 3.13.16, 3.14.8, and 3.15.0rc2 and later, which scope credential matching by URL scheme. Users should upgrade to these fixed versions. For those unable to upgrade immediately, mitigation involves ensuring that applications do not make plain HTTP requests to hosts for which credentials are registered, such as by avoiding redirects to HTTP URLs.
CVE-2026-15806: CWE-319 in Python Software Foundation CPython
Description
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.
CVSS v4.0
Score 6.0medium
Affected software
Python Software Foundation
CPython
pkg:github/CPythonRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The HTTPPasswordMgr class and its subclasses in Python's urllib.request module failed to differentiate URL schemes when matching stored credentials to requested URLs. As a result, credentials stored for HTTPS URLs were also sent over HTTP requests to the same host, and credentials for HTTP URLs could be sent over HTTPS. This flaw could be exploited by an attacker capable of redirecting or downgrading connections from HTTPS to HTTP, exposing credentials in cleartext. The fix scopes credential matching by URL scheme, ensuring credentials registered with a scheme are only used for requests with the same scheme. Credentials registered with a bare authority remain scheme-agnostic to maintain compatibility, including for proxy authentication.
Potential Impact
An attacker able to perform HTTPS-to-HTTP redirects or positioned on-path could capture sensitive credentials sent in cleartext due to the scheme-agnostic credential matching. This undermines the confidentiality of credentials managed by urllib.request's HTTPPasswordMgr classes. The vulnerability affects client applications using these classes for HTTP authentication, potentially exposing credentials during protocol downgrade or redirection attacks.
Mitigation Recommendations
A fix is available in Python versions 3.12.15, 3.13.16, 3.14.8, and 3.15.0rc2 and later, which scope credential matching by URL scheme. Users should upgrade to these fixed versions. For those unable to upgrade immediately, mitigation involves ensuring that applications do not make plain HTTP requests to hosts for which credentials are registered, such as by avoiding redirects to HTTP URLs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PSF
- Date Reserved
- 2026-07-15T08:49:13.390Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8482f3c6e8be03326f9af4
Added to database: 08/18/2026, 16:06:11 UTC
Last enriched: 10/01/2026, 15:33:44 UTC
Last updated: 10/02/2026, 02:46:03 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.