CVE-2026-40072

🗓️ 09 Apr 2026 18:17:03Reported by [email protected]Type

Web3.py CCIP Read enables SSRF by issuing HTTP requests to contract URLs in backend calls.

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for Server-Side Request Forgery in Apeworx Web3.Py	5 Jun 202609:05	–	githubexploit
ATTACKERKB	CVE-2026-40072	9 Apr 202617:41	–	attackerkb
Circl	CVE-2026-40072	2 Apr 202620:31	–	circl
CNNVD	web3.py 代码问题漏洞	9 Apr 202600:00	–	cnnvd
CVE	CVE-2026-40072	9 Apr 202617:41	–	cve
Cvelist	CVE-2026-40072 web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling	9 Apr 202617:41	–	cvelist
EUVD	EUVD-2026-21000	9 Apr 202617:41	–	euvd
Github Security Blog	web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling	4 Apr 202606:38	–	github
OSV	GHSA-5HR4-253G-CPX2 web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling	4 Apr 202606:38	–	osv
Positive Technologies	PT-2026-31674	4 Apr 202600:00	–	ptsecurity

NVD

Node

apeworx web3.pyRange6.1.0–7.15.0python

apeworx web3.pyMatch6.0.0-python

apeworx web3.pyMatch6.0.0beta10python

apeworx web3.pyMatch6.0.0beta11python

apeworx web3.pyMatch6.0.0beta3python

apeworx web3.pyMatch6.0.0beta4python

apeworx web3.pyMatch6.0.0beta5python

apeworx web3.pyMatch6.0.0beta6python

apeworx web3.pyMatch6.0.0beta7python

apeworx web3.pyMatch6.0.0beta8python

apeworx web3.pyMatch6.0.0beta9python

apeworx web3.pyMatch8.0.0beta1python

Source	Link
github	www.github.com/ethereum/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e
github	www.github.com/ethereum/web3.py/security/advisories/GHSA-5hr4-253g-cpx2

17 Jun 2026 10:44Current

CVSS 3.17.2

CVSS 46.3

EPSS0.00228