Executive brief
requests-hardened is a Python library designed to provide secure defaults and protection against web-based attacks. A vulnerability in its security filters allows attackers to bypass protections and access internal network services that should be restricted. This could lead to the exposure of sensitive internal data or unauthorized access to private cloud infrastructure, particularly in environments like AWS EKS.
Technical details
A Server-Side Request Forgery (SSRF) bypass exists in requests-hardened due to incomplete IP address filtering. The library's protection logic failed to include the RFC 6598 Shared Address Space (100.64.0.0/10) in its blocklist. An attacker who can provide arbitrary URLs to the library can target internal services hosted within this range, which is commonly used for pod networking in AWS EKS and other CG-NAT environments. The vulnerability is exploited via network requests where the attacker controls the destination URL. The issue is resolved in version 1.2.1 by expanding the IP filter to include RFC 6598 and other reserved ranges like multicast.
Affected products
- Saleor requests-hardened < 1.2.1
Timeline
- 2026-04-27: patched: Version 1.2.1 released
- 2026-04-27: advisory: GitHub Security Advisory GHSA-vh75-fwv3-pqrh published
- 2026-05-12: disclosed: CVE-2026-42175 published to NVD
References
- https://github.com/saleor/requests-hardened/commit/a266b3958bb142bca515b3c230fdea19fbda327c
- https://github.com/saleor/requests-hardened/commit/b7403f88d3b3689e57435b75b51691a160aaeef5
- https://github.com/saleor/requests-hardened/releases/tag/v1.2.1
- https://github.com/saleor/requests-hardened/security/advisories/GHSA-vh75-fwv3-pqrh