CVE-2026-35586: pyLoad Auth Bypass Vulnerability

CVE-2026-35586 Overview

CVE-2026-35586 is an Authorization Bypass vulnerability in pyLoad, a free and open-source download manager written in Python. The vulnerability exists due to an incorrect option name mismatch in the ADMIN_ONLY_CORE_OPTIONS authorization set within the set_config_value() function. The admin-only check uses incorrect option names ssl_cert and ssl_key, while the actual configuration option names are ssl_certfile and ssl_keyfile. This naming discrepancy causes the admin-only authorization check to always evaluate to False, enabling any user with SETTINGS permission to overwrite SSL certificate and key file paths. Additionally, the ssl_certchain option was never included in the admin-only set.

Critical Impact

Users with SETTINGS permission can bypass administrative controls to modify SSL certificate and key file paths, potentially enabling man-in-the-middle attacks or SSL/TLS security compromise.

Affected Products

• pyLoad versions prior to 0.5.0b3.dev97

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-35586 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35586

Vulnerability Analysis

This Authorization Bypass vulnerability (CWE-863: Incorrect Authorization) stems from a simple but impactful coding error in pyLoad's configuration management system. The set_config_value() function implements an admin-only check designed to restrict modification of sensitive SSL configuration options. However, due to a naming inconsistency between the authorization check and the actual configuration schema, this security control fails silently.

The vulnerability allows privilege escalation where users with only SETTINGS permission can perform actions that should require administrative privileges. By modifying the SSL certificate and key file paths, an attacker could potentially redirect SSL/TLS operations to use attacker-controlled certificates, undermining the confidentiality and integrity of encrypted communications.

Root Cause

The root cause is a name mismatch between the option names defined in ADMIN_ONLY_CORE_OPTIONS (ssl_cert, ssl_key) and the actual configuration parameter names used by pyLoad (ssl_certfile, ssl_keyfile). When the authorization check compares the incoming configuration option against the admin-only set, it never finds a match because the names differ. This causes the check to incorrectly return False (not admin-only), bypassing the intended restriction.

Furthermore, the ssl_certchain option was entirely omitted from the admin-only set, representing a second oversight that compounds the security issue.

Attack Vector

The vulnerability is exploitable over the network by authenticated users who possess SETTINGS permission. The attack requires:

1. Valid authentication to the pyLoad instance
2. SETTINGS permission (a lower privilege level than admin)
3. Knowledge of the correct SSL configuration option names

An attacker can send configuration change requests targeting ssl_certfile, ssl_keyfile, or ssl_certchain options. Since the authorization bypass allows these modifications, the attacker can point the SSL configuration to malicious certificate files, potentially enabling:

• Man-in-the-middle attacks on encrypted connections
• SSL/TLS certificate spoofing
• Denial of service by pointing to non-existent certificate files

For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35586

Indicators of Compromise

• Unexpected changes to SSL certificate or key file paths in pyLoad configuration
• Configuration audit logs showing SSL-related settings modified by non-admin users
• SSL/TLS errors or certificate warnings when connecting to the pyLoad instance
• Presence of unauthorized certificate files in unexpected directories

Detection Strategies

• Monitor configuration change events in pyLoad logs for modifications to ssl_certfile, ssl_keyfile, or ssl_certchain options
• Implement file integrity monitoring on SSL certificate and key files referenced by pyLoad
• Review user permission assignments to identify accounts with SETTINGS permission that could exploit this vulnerability
• Deploy network traffic analysis to detect potential man-in-the-middle scenarios involving the pyLoad service

Monitoring Recommendations

• Enable verbose logging for configuration changes in pyLoad and centralize log collection
• Set up alerts for any SSL configuration modifications, regardless of the user's privilege level
• Perform regular audits of user permissions, limiting SETTINGS access to trusted accounts only
• Monitor SSL certificate validity and chain integrity for the pyLoad service

How to Mitigate CVE-2026-35586

Immediate Actions Required

• Upgrade pyLoad to version 0.5.0b3.dev97 or later immediately
• Review configuration change logs to identify any unauthorized SSL setting modifications
• Audit user accounts with SETTINGS permission and remove unnecessary access
• Verify SSL certificate and key file paths are correctly configured and point to legitimate files

Patch Information

This vulnerability is fixed in pyLoad version 0.5.0b3.dev97. The fix corrects the option names in ADMIN_ONLY_CORE_OPTIONS to match the actual configuration parameter names (ssl_certfile, ssl_keyfile) and adds the missing ssl_certchain option to the admin-only set.

For complete patch details, see the GitHub Security Advisory.

Workarounds

• Restrict SETTINGS permission to only fully trusted administrator accounts until the patch is applied
• Implement network-level access controls to limit who can access the pyLoad configuration interface
• Use a reverse proxy with additional authentication layers in front of pyLoad
• Monitor and alert on any SSL configuration file path changes as an interim detection measure

# Configuration example
# Verify current pyLoad version
pyload --version

# Upgrade pyLoad to patched version
pip install --upgrade pyload-ng>=0.5.0b3.dev97

# Review users with SETTINGS permission in pyLoad configuration
# Restrict SSL configuration access at the network level if upgrade is not immediately possible