CVE-2026-15806: 
Python Interpreter vulnerability analysis and mitigation

CVE-2026-15806 is a credential disclosure vulnerability in Python's urllib.request module affecting the HTTPPasswordMgr class and its subclasses (HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth). The flaw causes credentials registered for an https:// URL to also be sent over plain http:// to the same host, and vice versa, because the reduce_uri() method discards the URL scheme during credential matching. It affects CPython versions prior to 3.15.0 (with backports required for 3.10–3.14) and was disclosed on August 18, 2026. It carries a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, oss-security).

The root cause is classified under CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials). The HTTPPasswordMgr.reduce_uri() method in Lib/urllib/request.py strips the URL scheme when normalizing URIs for credential lookup, meaning https://example.com and http://example.com resolve to the same internal key. An attacker in an on-path position or capable of issuing an HTTPS-to-HTTP redirect can trigger the vulnerable Python client to transmit HTTPS-registered credentials over unencrypted HTTP, where they can be captured in cleartext. A public proof-of-concept was included in the original bug report, demonstrating that using HTTPPasswordMgrWithPriorAuth with is_authenticated=True causes the Authorization header to be added to an HTTP request for credentials registered under an HTTPS URL (CPython Issue #155694, CPython PR #155696).

Successful exploitation allows a network attacker to capture HTTP Basic Authentication credentials in cleartext that were intended only for HTTPS connections. The impact is limited to confidentiality — there is no integrity or availability impact — but stolen credentials can enable unauthorized access to protected resources, account takeover, or lateral movement if the same credentials are reused across services. Any Python application using urllib.request with HTTPPasswordMgr or its subclasses and registering credentials with scheme-qualified URLs is potentially affected (GitHub Advisory, oss-security).

A proof-of-concept script was published as part of the original bug report (CPython issue #155694), demonstrating the vulnerability without requiring a live server. The EPSS score is 0.0, indicating low current probability of exploitation in the wild, and there is no evidence of active exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be in an on-path network position or able to issue redirects, making it non-trivially automatable (CPython Issue #155694, GitHub Advisory).

1. Identify a target application: Locate a Python application using urllib.request with HTTPPasswordMgr, HTTPPasswordMgrWithDefaultRealm, or HTTPPasswordMgrWithPriorAuth that registers credentials for an https:// URL and may follow HTTP redirects.
2. Position for interception or redirect: Gain an on-path network position (e.g., ARP spoofing on a local network, rogue Wi-Fi access point) or control a server that can issue an HTTPS-to-HTTP redirect response (HTTP 301/302 pointing to http://).
3. Trigger a downgrade: Cause the vulnerable Python client to follow a redirect from https://example.com/ to http://example.com/. Because reduce_uri() discards the scheme, the password manager matches the stored HTTPS credentials to the HTTP request.
4. Capture credentials in cleartext: Intercept the resulting HTTP request on the network. The Authorization: Basic <base64> header will be present and decodable, exposing the plaintext username and password.
5. Use captured credentials: Decode the Base64-encoded credentials and use them to authenticate against the target service or other services where credentials are reused (CPython Issue #155694, oss-security).

• Network: Unexpected HTTP (plaintext) requests to hosts that should only be accessed over HTTPS, containing an Authorization: Basic header; HTTP 301/302 redirect responses from HTTPS endpoints pointing to http:// URLs observed in network traffic captures.
• Logs: Application or proxy logs showing HTTP requests (not HTTPS) to sensitive endpoints with Authorization headers; redirect chains in access logs transitioning from https:// to http:// for the same host.
• Process/Application: Python application logs indicating unexpected HTTP connections to hosts registered with HTTPS credentials; unusual redirect-following behavior in urllib.request-based clients.

Upgrade to a patched version of CPython: the fix was merged into main (targeting 3.16) on August 17, 2026, and backported to branches 3.10 through 3.15 (PRs #155968–#155973). Users who cannot upgrade immediately should ensure their applications never make plain http:// requests to hosts for which credentials are registered — specifically, configure applications to not follow redirects to http:// URLs. Credentials registered with a bare authority (e.g., example.com without a scheme) continue to match any scheme and are unaffected by the fix (CPython PR #155696, GitHub Advisory).

The Python Security team disclosed the vulnerability via the official security-announce@python.org mailing list on August 18, 2026, and it was forwarded to the oss-security list by Alan Coopersmith. The fix was reviewed and approved by CPython core developers Eclips4 and Seth Michael Larson before being merged. Community discussion was noted on Bluesky (infosec.skyfleet.blue) shortly after disclosure (oss-security, CPython PR #155696).