← Vulnerability feed

Vulnerability record · CVE-2026-42312 · published 11 May 2026

CVE-2026-42312: Pyload-ng project pyload-ng improper certificate validation vulnerability

PPyload Ng Project · Pyload Ng

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general", "ssl_verify") is not on that allowlist. Any authenticated user with the non-admin SETTINGS permission can set general.ssl_verify = off, and every subsequent outbound pycurl request is made with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0 — TLS peer and hostname verification are fully disabled. An on-path attacker can then present forged certificates for any hostname pyload fetches. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

6.8 CVSS 3.1 Medium EPSS 0.19% · top 92.3% CWE-295 · Improper certificate validationCWE-306 · Missing authentication for critical function
6.8CVSS 3.1 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general", "ssl_verify") is not on that allowlist. Any authenticated user with the non-admin SETTINGS permission can set general.ssl_verify = off, and every subsequent outbound pycurl request is made with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0 — TLS peer and hostname verification are fully disabled. An on-path attacker can then present forged certificates for any hostname pyload fetches. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pyload/pyload/security/advisories/GHSA-ccxc-x975-4hh9 ExploitVendor Advisory
https://github.com/pyload/pyload/security/advisories/GHSA-ccxc-x975-4hh9 ExploitVendor Advisory

Track CVE-2026-42312 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-54802Pyload-ng project pyload-ng path traversal vulnerabilitypyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path tra…EPSS 1.2%9.3CVE-2026-35459Pyload-ng project pyload-ng server-side request forgery (ssrf) vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vu…EPSS 0.38%8.8CVE-2026-35463Pyload-ng project pyload-ng os command injection vulnerabilitypyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restri…EPSS 0.91%8.8CVE-2026-33509Pyload improper privilege management vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API e…EPSS 0.58%8.8CVE-2026-33511Pyload insecure direct object reference vulnerabilitypyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator i…EPSS 0.62%8.8CVE-2024-22416Pyload-ng project pyload-ng cross-site request forgery vulnerabilitypyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since t…EPSS 0.95%8.3CVE-2026-42313Pyload-ng project pyload-ng incorrect authorization vulnerabilitypyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SE…EPSS 0.39%8.1CVE-2026-32808Pyload path traversal vulnerabilitypyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password v…EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2026-42312), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.