{"id":"CVE-2026-40072","aliases":["GHSA-5hr4-253g-cpx2","PYSEC-2026-3414"],"url":"https://o3.security/vulnerability/CVE-2026-40072","summary":"web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling","details":"web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup (EIP-3668) by performing HTTP requests to URLs supplied by smart contracts in offchain_lookup_payload[\"urls\"]. The implementation uses these contract-supplied URLs directly (after {sender} / {data} template substitution) without any destination validation. CCIP Read is enabled by default (global_ccip_read_enabled = True on all providers), meaning any application using web3.py's .call() method is exposed without explicit opt-in. This results in Server-Side Request Forgery (SSRF) when web3.py is used in backend services, indexers, APIs, or any environment that performs eth_call / .call() against untrusted or user-supplied contract addresses. A malicious contract can force the web3.py process to issue HTTP requests to arbitrary destinations, including internal network services and cloud metadata endpoints. This vulnerability is fixed in 7.15.0 and 8.0.0b2.","published":"2026-04-09T17:41:14.920Z","modified":"2026-07-15T01:48:54.654953274Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"web3","fixedVersion":"7.15.0"},{"ecosystem":"PyPI","name":"web3","fixedVersion":"8.0.0b2"}],"fix":{"url":"https://github.com/ethereum/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e","label":"ethereum/web3.py@b1c57bb"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40072.json"},{"type":"ADVISORY","url":"https://github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40072"},{"type":"FIX","url":"https://github.com/ethereum/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:54.654953274Z"}}