CVE-2026-42175: requests-hardened SSRF Vulnerability

CVE-2026-42175 Overview

CVE-2026-42175 is a Server-Side Request Forgery (SSRF) bypass [CWE-918] in the requests-hardened Python library maintained by Saleor. The library wraps the popular requests package and adds security controls intended to block requests to internal IP ranges. Prior to version 1.2.1, the SSRF protection failed to block IP addresses within the RFC 6598 Shared Address Space (100.64.0.0/10). An attacker who supplies arbitrary URLs to an application using requests-hardened can reach internal services hosted in that range. This is particularly relevant in AWS EKS deployments, where 100.64.0.0/10 is commonly used as the default pod CIDR.

Critical Impact
Attackers can bypass SSRF protections to reach internal workloads inside 100.64.0.0/10, including Kubernetes pods in AWS EKS clusters using the default pod CIDR.

Affected Products

saleor/requests-hardened Python library prior to version 1.2.1
Applications routing user-controlled URLs through requests-hardened
Deployments using 100.64.0.0/10 for internal networking (e.g., AWS EKS pod CIDR)

Discovery Timeline

2026-05-12 - CVE-2026-42175 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42175

Vulnerability Analysis

The requests-hardened library enforces SSRF protections by resolving target hostnames and rejecting addresses that fall within disallowed CIDR ranges. The vulnerable releases relied on standard private and reserved network checks but omitted RFC 6598 Carrier-Grade NAT (CG-NAT) space. Because 100.64.0.0/10 is not classified as private by Python's ipaddress module, requests to hosts resolving into that range passed the filter. In environments where the CG-NAT block is repurposed for internal routing, this gap exposes services that operators assume are unreachable from external request paths.

Root Cause

The root cause is an incomplete deny list inside requests_hardened/ip_filter.py. The module did not declare 100.64.0.0/10 (and several other operationally sensitive ranges) as blocked networks. The fix introduces an EXTRA_BLOCKED_NET_RANGES tuple and a helper _is_ip_in_extra_blocked_ranges that evaluates resolved IPs against the additional CIDRs before allowing the request to proceed.

Attack Vector

Exploitation requires the application to accept attacker-controlled URLs and dispatch them through requests-hardened. The attacker supplies a URL whose hostname resolves to an address inside 100.64.0.0/10. The hardened client resolves the hostname, fails to flag the IP as internal, and issues the HTTP request to the internal target. In AWS EKS clusters that use the default pod CIDR, this can expose pod IPs, internal APIs, and service-mesh endpoints to unauthenticated callers.

python

 logger = logging.getLogger(__name__)
 
 # Additional CIDRs that should be blocked
-EXTRA_BLOCKED_NET_RANGES: tuple[ipaddress.IPv4Network | ipaddress.IPv6Network, ...] = (
+EXTRA_BLOCKED_NET_RANGES: tuple[
+    Union[ipaddress.IPv4Network, ipaddress.IPv6Network], ...
+] = (
     ipaddress.ip_network("192.88.99.0/24"),  # 6to4 relay anycast
     ipaddress.ip_network("100.64.0.0/10"),  # CG-NAT, can route to internal workloads
     ipaddress.ip_network("5f00::/16"),  # IPv6 Segment Routing
     ipaddress.ip_network("64:ff9b::/96"),  # used for IPv6 & IPv4 translation (NAT64)
     ipaddress.ip_network("2001:20::/28"),  # ORCHIDv2 (overlay identifiers)
+
+    # Fixes https://github.com/python/cpython/issues/113171 for outdated CPython
+    # installations.
+    ipaddress.ip_network("192.0.0.0/24"),
+    ipaddress.ip_network("64:ff9b:1::/48"),
+    ipaddress.ip_network("2002::/16"),
+    ipaddress.ip_network("3fff::/20"),
 )

Source: GitHub Commit a266b39. The patch extends the blocked-network tuple to include CG-NAT and additional translation ranges.

Detection Methods for CVE-2026-42175

Indicators of Compromise

Outbound HTTP requests from application workers to destinations inside 100.64.0.0/10 that did not originate from normal internal service calls.
Application logs showing successful requests-hardened calls to hostnames resolving into CG-NAT space.
Unexpected access patterns against EKS pod IPs from ingress-facing services that accept user-supplied URLs.

Detection Strategies

Inventory Python dependencies for requests-hardened versions earlier than 1.2.1 using SBOM tooling or pip list.
Inspect application code paths that pass external URLs to requests-hardened and correlate outbound flows with VPC flow logs.
Add allow-list validation in proxy layers to alert on egress requests from application tiers targeting 100.64.0.0/10.

Monitoring Recommendations

Forward VPC Flow Logs, Kubernetes audit logs, and application access logs to a centralized analytics platform for correlation against CG-NAT destinations.
Alert on DNS resolutions returning 100.64.0.0/10 answers for hostnames passed to user-facing services.
Track changes to dependency manifests (requirements.txt, poetry.lock) to confirm the library has been upgraded across all services.

How to Mitigate CVE-2026-42175

Immediate Actions Required

Upgrade requests-hardened to version 1.2.1 or later across all services and container images.
Audit application endpoints that accept user-controlled URLs and confirm they route through the patched library.
Review AWS EKS clusters and other environments that use 100.64.0.0/10 for internal networking and verify no exposed services rely solely on network isolation.

Patch Information

The vulnerability is fixed in requests-hardenedv1.2.1. The fix is implemented in commits a266b39 and b7403f8, which add 100.64.0.0/10 and several other ranges to the blocked CIDR list. Details are documented in GitHub Security Advisory GHSA-vh75-fwv3-pqrh and the v1.2.1 release notes.

Workarounds

Pin or fork requests-hardened and extend EXTRA_BLOCKED_NET_RANGES to include 100.64.0.0/10 if upgrading is not immediately feasible.
Enforce egress filtering at the network layer (security groups, NACLs, service mesh policies) to block outbound traffic from application tiers to 100.64.0.0/10.
Validate and allow-list URL hostnames before passing them to any HTTP client, rejecting inputs that resolve to CG-NAT, link-local, or private ranges.

bash

# Upgrade the affected dependency
pip install --upgrade "requests-hardened>=1.2.1"

# Verify the installed version
pip show requests-hardened | grep -i version