CVE-2026-42175 requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598
Attackers can bypass SSRF protections to access internal services in the RFC 6598 address space, impacting environments using this CIDR range.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42175?
CVE-2026-42175 is a medium-severity server-side request forgery vulnerability in saleor requests-hardened, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
requests-hardened is a library that overrides the default behaviors of the requests library, and adds new security features. Prior to , the SSRF protection in requests-hardened fails to block IP addresses within the RFC 6598 Shared Address Space (100.64.0.0/10). An attacker who can supply arbitrary URLs to requests-hardened could exploit this gap to access internal services hosted within 100.64.0.0/10. This is for example relevant in environments such as AWS EKS where 100.64.0.0/10 is commonly used as the default pod CIDR. The impact is environment-dependent, deployments that utilize the affected CIDR range for internal networking are exposed to SSRF bypass, while others may not be affected. This vulnerability is fixed in .
Weakness: CWE-918
Which versions are affected by CVE-2026-42175?
3 open source packages ship an affected version, including requests-hardened.
| Package | Affected | Fixed in |
|---|---|---|
requests-hardened PyPI | All versions | 1.2.1 |
requests-hardened PyPI | All versions | 1.2.1 |
requests-hardened PyPI | All versions | 1.2.1 |
How do I fix CVE-2026-42175?
Upgrade requests-hardened to 1.2.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-42175 being exploited?
There is no known exploitation of CVE-2026-42175 in the wild and no public exploit code.
Sources
Also known as GHSA-vh75-fwv3-pqrh, PYSEC-2026-3050.