---
id: CVE-2026-78682
title: >-
  nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration
  (CVE-2026-78682)
summary: >-
  A flaw was found in NLTK. When an HTTP proxy is configured, a server-side
  request forgery (SSRF) vulnerability exists in the `nltk.pathsec.urlopen`
  function. An attacker can exploit this by providing a seemingly valid public
  URL, which the…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-918
  - CWE-441
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - exploit_intelligence
  - lightspeed_core
  - openshift_lightspeed
  - ansible_automation_platform 2
  - openshift_ai_rhoai
patched:
  - nltk 3.10.3
published: '2026-08-25'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T13:22:04+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78682.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78682.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-78682'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2523191'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-78682'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78682'
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh'
  - url: >-
      https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy
  - url: >-
      https://github.com/nltk/nltk/commit/767333a005a1cd3d82d2029215f2dbe66a5844d9
  - url: 'https://github.com/nltk/nltk'
  - url: 'https://github.com/nltk/nltk/releases/tag/v3.10.3'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3733.yaml
  - url: 'https://github.com/advisories/GHSA-6ww7-3frv-cqxh'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - ghsa
epss: 0.00253
epssPercentile: 0.17151
aliases:
  - GHSA-6ww7-3frv-cqxh
  - PYSEC-2026-3733
ecosystem: pip
ingestedAt: '2026-09-02T19:31:24.306Z'
---

## Overview

A flaw was found in NLTK. When an HTTP proxy is configured, a server-side request forgery (SSRF) vulnerability exists in the `nltk.pathsec.urlopen` function. An attacker can exploit this by providing a seemingly valid public URL, which the proxy then forwards to an internal service without proper re-validation. This could lead to the disclosure of internal network resources, the loading of malicious downloader indexes, and the installation of attacker-controlled package content.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78682.json)

**nltk: NLTK: Server-Side Request Forgery via HTTP Proxy Configuration** — rated Important by Red Hat. Released 2026-08-25, updated 2026-09-15.

Affected:

- Exploit Intelligence
- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Exploit Intelligence
- Red Hat Ansible Automation Platform 2
- Lightspeed Core
- OpenShift Lightspeed
- Red Hat OpenShift AI (RHOAI)

## Remediation

Will not fix

Workarounds / mitigations:

- To mitigate this issue, avoid configuring an HTTP proxy for NLTK if it is not strictly necessary. If an HTTP proxy must be used, implement strict network egress filtering to prevent NLTK from initiating connections to internal or loopback network addresses. This measure restricts the potential for an attacker to exploit the SSRF to access internal resources.

## Package advisory (CVE-2026-78682)

Affected packages:

- `nltk < 3.10.3`

Patched in:

- `nltk 3.10.3`

Source: https://osv.dev/vulnerability/GHSA-6ww7-3frv-cqxh