CVE-2026-42312: pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
(updated )
The set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general", "ssl_verify") is not on that allowlist. Any authenticated user with the non-admin SETTINGS permission can set general.ssl_verify = off, and every subsequent outbound pycurl request is made with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0 — TLS peer and hostname verification are fully disabled. An on-path attacker can then present forged certificates for any hostname pyload fetches.
This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist.
References
- github.com/advisories/GHSA-4744-96p5-mp2j
- github.com/advisories/GHSA-ccxc-x975-4hh9
- github.com/advisories/GHSA-ppvx-rwh9-7rj7
- github.com/advisories/GHSA-r7mc-x6x7-cqxx
- github.com/advisories/GHSA-w48f-wwwf-f5fr
- github.com/pyload/pyload/security/advisories/GHSA-ccxc-x975-4hh9
- github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2026-126.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-42312
Code Behaviors & Features
Detect and mitigate CVE-2026-42312 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →