Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-58501: Zeep SOAP client may retrieve attacker-controlled URLs
CVE-2026-58501 · published 3 months ago
Summary
The Zeep Python library (versions 4.0.0 through 4.3.2) does not correctly block external network calls when it reads service definitions, so it can be tricked into loading files from any HTTP or HTTPS address. This could let an attacker cause your system to contact malicious sites or expose internal resources. Upgrade Zeep to version 4.3.3 or later to enforce the restriction.
What to do
- Update michael van tellingen zeep to version 4.3.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | michael van tellingen | zeep |
>= 4.0.0, < 4.3.3 Fix: upgrade to 4.3.3
|
Original advisory text
Zeep SSRF because Settings.forbid_external is not enforced
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fixed in version 4.3.3.
References
- https://github.com/advisories/GHSA-4cc2-g9w2-fhf6
- https://github.com/mvantellingen/python-zeep/releases/tag/4.3.3 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58501... Vendor Advisory
- https://github.com/mvantellingen/python-zeep/security/advisories/GHSA-4cc2-g9w2-... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58501 Vendor Advisory
- https://github.com/mvantellingen/python-zeep/commit/83eb07bc6c84d841329d4f88856f... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published8 Jul 2026
Updated21 Oct 2026
First seen19 Jun 2026
Track software like this
Free during beta