CVE-2026-33992

The PyLoad download engine does not verify the URLs passed to it before processing, which is a classic case of CWE-918 (SSRF). An attacker with access to an account in the application can provide a URL pointing to internal resources — for example, cloud instance metadata servers. In the case of DigitalOcean environments, this allows querying cloud metadata endpoints and retrieving sensitive infrastructure data, such as droplet identifier, network configuration, region, authentication keys, and SSH keys defined in user-data/cloud-init.

An attacker can gain access to internal network services unavailable from the outside and steal sensitive infrastructure data from cloud provider metadata services, including SSH keys and credentials, which may lead to further compromise of the environment.

PyLoad should be updated to version 0.5.0b3.dev97 or newer, which contains a patch eliminating the vulnerability. The patch is available in the project repository on GitHub (commit b76b6d4ee5e32d2118d26afdee1d0a9e57d4bfe8). Additionally, it is recommended to restrict access to the PyLoad interface only to trusted users and to consider network segmentation blocking instance access to cloud metadata endpoints (e.g., through network-level firewall).

PyLoad in all versions preceding 0.5.0b3.dev97