CVE-2026-33314: Improper Authentication and Origin Validation Error in pyload-ng

March 19, 2026 (updated June 8, 2026)

A Host Header Spoofing vulnerability in the @local_check decorator allows unauthenticated external attackers to bypass local-only restrictions. This grants access to the Click’N’Load API endpoints, enabling attackers to remotely queue arbitrary downloads, leading to Server-Side Request Forgery (SSRF) and Denial of Service (DoS).

References

github.com/advisories/GHSA-q485-cg9q-xq2r
github.com/pyload/pyload/security/advisories/GHSA-q485-cg9q-xq2r
github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-122.yaml
nvd.nist.gov/vuln/detail/CVE-2026-33314

Code Behaviors & Features

Detect and mitigate CVE-2026-33314 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →