cve-2026-40072-ssrf-lab

CVE-2026-40072 SSRF Lab Hands-on local lab to demonstrate CVE-2026-40072 in web3.py, show the SSRF impact in Burp Suite, and verify the official fix. Overview This repository contains a safe, local-only proof of concept for CVE-2026-40072, a Server-Side Request Forgery SSRF issue tied to CCIP Rea...

CVE-2026-40072: Server-Side Request Forgery (SSRF)

web3.py allows you to interact with the Ethereum blockchain using Python. From 6.0.0b3 to before 7.15.0 and 8.0.0b2, web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these...