CoreCVE
Back

CRITICAL

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Published Mar 27, 2026

Description

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init. Version 0.5.0b3.dev97 contains a patch.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Mar 27, 2026
Updated Mar 30, 2026
Reserved Mar 24, 2026
Link CVE-2026-33992
CISA Vulnrichment
Updated Mar 30, 2026
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2026-33992
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-33992
ENISA EUVD
Assigner GitHub_M
Published Mar 27, 2026
Updated Mar 30, 2026
Exploited since n/a
Link EUVD-2026-16886
EUVD-2026-16886 GHSA-M74M-F7CR-432X