CVE-2026-33314: Pyload-ng SSRF Vulnerability

CVE-2026-33314 Overview

CVE-2026-33314 is an Authentication Bypass vulnerability affecting pyLoad, a free and open-source download manager written in Python. The vulnerability exists in the @local_check decorator, which is intended to restrict access to certain API endpoints to local connections only. Due to improper validation of the Host header, unauthenticated external attackers can spoof this header to bypass local-only restrictions, gaining unauthorized access to the Click'N'Load API endpoints.

Critical Impact

Successful exploitation allows remote attackers to bypass authentication controls and queue arbitrary downloads, potentially leading to Server-Side Request Forgery (SSRF) and Denial of Service (DoS) conditions.

Affected Products

• pyload-ng versions prior to 0.5.0b3.dev97
• pyLoad Click'N'Load API endpoints
• Systems running pyLoad with network-accessible interfaces

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-33314 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33314

Vulnerability Analysis

The vulnerability stems from improper authentication validation in the @local_check decorator within pyLoad. This decorator is designed to ensure that certain sensitive API endpoints, particularly those related to the Click'N'Load functionality, are only accessible from the local machine. However, the implementation relies on the Host header provided in HTTP requests to determine whether the request originates from a local source.

An attacker can craft malicious HTTP requests with spoofed Host headers to trick the application into believing the request is coming from localhost. This bypasses the intended security control and grants the attacker access to protected API endpoints without any authentication.

The impact is twofold: first, attackers can leverage the Click'N'Load API to queue arbitrary download URLs, which can be abused for SSRF attacks by forcing the server to make requests to internal or external resources. Second, by flooding the download queue with requests, attackers can cause resource exhaustion leading to Denial of Service conditions.

Root Cause

The root cause of this vulnerability is improper authentication (CWE-287) in the @local_check decorator. The decorator fails to properly validate the actual source IP address of incoming requests and instead relies on the easily manipulated Host header. This design flaw allows network-based attackers to bypass access controls that were intended to restrict functionality to local users only.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the pyLoad web interface can exploit this vulnerability by:

1. Crafting HTTP requests with a spoofed Host header set to localhost or 127.0.0.1
2. Sending these requests to the Click'N'Load API endpoints
3. Successfully bypassing the @local_check decorator validation
4. Queuing arbitrary download URLs to the pyLoad download manager

The vulnerability can be exploited remotely over the network. An attacker sends HTTP requests to the pyLoad web interface with a manipulated Host header, causing the @local_check decorator to incorrectly identify the request as originating from localhost. This grants access to the Click'N'Load API, which can then be abused to initiate downloads from attacker-controlled URLs or internal network resources. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33314

Indicators of Compromise

• Unusual HTTP requests to Click'N'Load API endpoints from external IP addresses containing localhost-related Host headers
• Unexpected or unauthorized downloads appearing in the pyLoad queue
• Network traffic showing internal resource access initiated by the pyLoad server (SSRF indicators)
• High volume of download requests indicating potential DoS attempts

Detection Strategies

• Monitor web server access logs for requests to /flashgot or Click'N'Load-related endpoints with suspicious Host header values
• Implement network intrusion detection rules to identify Host header spoofing attempts targeting pyLoad instances
• Review pyLoad download logs for unauthorized or unexpected download entries
• Deploy web application firewall (WAF) rules to validate Host header values against expected domains

Monitoring Recommendations

• Enable verbose logging on pyLoad instances to capture all API requests and their associated headers
• Set up alerts for unusual download queue activity or rapid increases in queued downloads
• Monitor outbound network connections from the pyLoad server for signs of SSRF exploitation
• Implement rate limiting on API endpoints to detect and mitigate DoS attempts

How to Mitigate CVE-2026-33314

Immediate Actions Required

• Upgrade pyLoad to version 0.5.0b3.dev97 or later immediately
• Restrict network access to pyLoad instances using firewall rules to allow only trusted IP addresses
• If upgrade is not immediately possible, disable the Click'N'Load functionality until patching is complete
• Review download queues for any unauthorized entries and remove suspicious downloads

Patch Information

This vulnerability has been patched in pyLoad version 0.5.0b3.dev97. The fix addresses the Host header validation issue in the @local_check decorator by implementing proper source IP address verification instead of relying on client-provided headers. Users should upgrade to this version or later to remediate the vulnerability. For additional details, see the GitHub Security Advisory GHSA-q485-cg9q-xq2r.

Workarounds

• Configure a reverse proxy (such as nginx or Apache) in front of pyLoad to validate and enforce Host header values
• Implement network-level access controls to restrict access to the pyLoad web interface to trusted networks only
• Disable Click'N'Load functionality if not required for your deployment
• Use firewall rules to block external access to pyLoad API endpoints

# Example: Restrict pyLoad access to localhost only using iptables
iptables -A INPUT -p tcp --dport 8000 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP