CVE-2026-123814 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123814?
CVE-2026-123814 is a medium-severity vulnerability in pyload, published on 9 Nov 2026.
Official description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in src/pyload/plugins/addons/WindowsPhoneNotify.py then uses http.client.HTTPConnection without pyLoad's pycurl destination validation. When a download completes, the global notification event causes a blind POST from the pyLoad server to the attacker-selected internal host, port, and path. The response is not returned, but the request can probe internal services, reach cloud metadata endpoints, or trigger state-changing internal HTTP endpoints. This issue is fixed in version 0.5.0b3.dev102.
Weakness: CWE-918
Which versions are affected by CVE-2026-123814?
1 open source package ship an affected version, including pyload-ng.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions to 0.5.0b3.dev101 | None |
How do I fix CVE-2026-123814?
No fix has been published for CVE-2026-123814 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123814 being exploited?
There is no known exploitation of CVE-2026-123814 in the wild and no public exploit code.
Sources
Also known as GHSA-p3pr-8f3m-4qp8.