CVE-2026-40072: ApeWorX web3.py SSRF in CCIP Read OffchainLookup

Executive brief

A vulnerability in the web3.py library allows malicious smart contracts to force backend applications into making unauthorized network requests. This occurs because the library automatically follows links provided by contracts without verifying if they point to safe destinations. An attacker could use this to probe internal corporate networks, access sensitive cloud metadata, or interact with private internal services that are not intended to be reachable from the internet.

Technical details

The web3.py library implements EIP-3668 (CCIP Read) by automatically performing HTTP GET or POST requests to URLs provided in a contract's 'OffchainLookup' revert payload. The vulnerability stems from a lack of destination validation: the library does not restrict protocols to HTTPS, lacks hostname/IP allowlists, does not block private/reserved IP ranges (RFC1918, loopback, cloud metadata), and follows HTTP redirects by default via the 'requests' and 'aiohttp' libraries. An attacker can deploy a malicious contract that, when called via '.call()', forces the client to perform SSRF against internal infrastructure or cloud metadata services (e.g., AWS IMDS). The issue is mitigated in versions 7.15.0 and 8.0.0b2 by introducing URL validation and safer defaults.

Affected products

• ApeWorX web3.py >= 6.0.0b3, < 7.15.0; 8.0.0b1

Timeline

• 2026-04-02: disclosed
• 2026-04-04: advisory

References

• https://api.github.com/users/Nadav0077
• https://github.com/Nadav0077
• https://api.github.com/users/Nadav0077/gists%7B/gist_id%7D
• https://api.github.com/users/Nadav0077/repos
• https://avatars.githubusercontent.com/u/18245584?v=4
• https://api.github.com/users/Nadav0077/events%7B/privacy%7D