nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration (CVE-2026-78682)

Overview

A flaw was found in NLTK. When an HTTP proxy is configured, a server-side request forgery (SSRF) vulnerability exists in the nltk.pathsec.urlopen function. An attacker can exploit this by providing a seemingly valid public URL, which the proxy then forwards to an internal service without proper re-validation. This could lead to the disclosure of internal network resources, the loading of malicious downloader indexes, and the installation of attacker-controlled package content.

Vendor advisories

• Red Hat VEX · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, … · updated 2026-09-15 · vex

nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration — rated Important by Red Hat. Released 2026-08-25, updated 2026-09-15.

Affected:

• Exploit Intelligence
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat Ansible Automation Platform 2
• Red Hat OpenShift AI (RHOAI)

No fix planned:

• Exploit Intelligence
• Red Hat Ansible Automation Platform 2
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat OpenShift AI (RHOAI)

Remediation

Will not fix

Workarounds / mitigations:

• To mitigate this issue, avoid configuring an HTTP proxy for NLTK if it is not strictly necessary. If an HTTP proxy must be used, implement strict network egress filtering to prevent NLTK from initiating connections to internal or loopback network addresses. This measure restricts the potential for an attacker to exploit the SSRF to access internal resources.

Package advisory (CVE-2026-78682)

Affected packages:

• nltk < 3.10.3

Patched in:

• nltk 3.10.3

Source: https://osv.dev/vulnerability/GHSA-6ww7-3frv-cqxh