https://seclists.org/oss-sec/2026/q3/514: CPython [CVE-2026-15806] urllib.quest.HTTPPasswordMgr cdentials for one URL scheme sent over another scheme
Published Aug 18, 2026
·Updated
Affected Software
1 affected component
CPython
Frequently Asked Questions
1
What would an attacker need to capture credentials?
The attacker would need to redirect or downgrade a client to plain HTTP, such as through an HTTPS-to-HTTP redirect or an on-path position. In that situation, credentials originally registered for an HTTPS URL could be sent in cleartext.
2
Which applications are exposed?
Applications using urllib.request.HTTPPasswordMgr, HTTPPasswordMgrWithDefaultRealm, or HTTPPasswordMgrWithPriorAuth to store credentials for URLs are affected. The issue occurs when requests to the same host are made using a different URL scheme than the one used when credentials were registered.
3
Does the issue only affect HTTPS credentials being sent over HTTP?
No. Credentials registered for an HTTP URL could also be sent on requests to the same host over HTTPS; the vulnerable credential matching did not distinguish between schemes.