Search: CVE-2026-15806

CVE-2026-15806 is a vulnerability in the Python CPython urllib.request module where HTTPPasswordMgr classes did not consider the URL scheme when matching stored credentials. This caused credentials registered for HTTPS URLs to be sent over HTTP requests to the same host, exposing them to interception if an attacker could redirect or downgrade connections to plain HTTP. The issue is fixed by scoping credential matching to the URL scheme. Users unable to upgrade immediately should avoid making plain HTTP requests to hosts with stored credentials.