CVE-2026-8328 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
An attacker can exploit the Python ftplib module to perform Server-Side Request Forgery by manipulating PASV responses, bypassing previous security fixes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-8328?
CVE-2026-8328 is a medium-severity server-side request forgery vulnerability in CPython, published on 13 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Weakness: CWE-918
Which versions are affected by CVE-2026-8328?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6 |
python Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6 |
python-min Bitnami | All versions | 3.10.21, 3.11.16, 3.12.14, 3.13.14, 3.14.6 |
How do I fix CVE-2026-8328?
Upgrade libpython to a fixed version for your release line: 3.10.21, 3.11.16, 3.12.14 or 3.13.14.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-8328 being exploited?
There is no known exploitation of CVE-2026-8328 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-8328, AZL-86913, BELL-CVE-2026-8328, BIT-libpython-2026-8328, BIT-python-2026-8328, BIT-python-min-2026-8328 and 13 more.