CPython [CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme

[Alan Coopersmith <alan.coopersmith () oracle com>]

-------- Forwarded Message --------
Subject:        [Security-announce][CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent 
over another scheme
Date:   Tue, 18 Aug 2026 15:38:30 +0000
From:   Kirill Podoprigora via Security-announce <security-announce () python org>
Reply-To:       security-sig () python org
To:     security-announce () python org
CC:     Kirill Podoprigora <kirill.bast () gmail com>


There is a MEDIUM severity vulnerability affecting CPython.

  The HTTPPasswordMgr class in the urllib.request module, along with its
subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth,
did not take the URL scheme into account when matching stored credentials
against a requested URL. Credentials added for an https:// URL were also used
for requests to the same host over http://, so an attacker able to redirect or
downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect
or an on-path position) could capture credentials in cleartext. Credentials
added for http:// URLs could likewise be sent over https://.

  Credential matching is now scoped by URL scheme. Credentials registered with
a URL that includes a scheme are only used for requests with the same scheme.
Credentials registered with a bare authority (such as example.com or
example.com:8080) continue to match any scheme, preserving compatibility with
existing code, including proxy authentication.

  Users who cannot upgrade immediately can mitigate by ensuring that
applications never make plain http:// requests to hosts for which credentials
are registered, for example by not following redirects to http:// URLs.

Please see the linked CVE ID for the latest information on affected versions:
- https://www.cve.org/CVERecord?id=CVE-2026-15806
- https://github.com/python/cpython/pull/155696

_______________________________________________
Security-announce mailing list -- security-announce () python org
https://mail.python.org/mailman3//lists/security-announce.python.org