CVE-2026-40072

OVERVIEW CVE-2026-40072 affects web3.py, a Python library for Ethereum blockchain interactions, in versions 6.0.0b3 through 7.14.x and 8.0.0b1. The vulnerability stems from unsafe implementation of CCIP Read (EIP-3668), which performs HTTP requests to URLs supplied directly by smart contracts without destination validation. Because CCIP Read is enabled by default, all applications using web3.py's .call() method are exposed without requiring explicit opt-in. SEVERITY This Server-Side Request Forgery (SSRF) vulnerability carries significant risk in backend contexts. The attack vector is network-based and requires low complexity, as attackers need only deploy a malicious smart contract that supplies arbitrary URLs. The impact is severe for applications operating in backend services, indexers, APIs, or cloud environments, as SSRF can force web3.py to issue HTTP requests to internal network services and cloud metadata endpoints, potentially leading to information disclosure or lateral movement. The FAUCET Risk Score of 23.0/100 and EPSS score of 0.00054 indicate moderate concern within the vulnerability landscape. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on exploit tracking lists. However, the straightforward nature of the attack—requiring only deployment of a malicious contract—suggests exploitation could occur if the vulnerability remains unpatched in production environments. Organizations should prioritize patching to versions 7.15.0 or 8.0.0b2 or later.