CVE-2026-42312 Overview
CVE-2026-42312 is a certificate validation vulnerability [CWE-295] in pyLoad, an open-source download manager written in Python. The flaw resides in the set_config_value() API method in src/pyload/core/api/__init__.py. The function relies on a hand-maintained allowlist named ADMIN_ONLY_CORE_OPTIONS to gate security-sensitive options. The ("general", "ssl_verify") option is missing from that allowlist. Any authenticated user holding the non-admin SETTINGS permission can disable TLS verification globally. The issue is fixed in version 0.5.0b3.dev100.
Critical Impact
Disabling ssl_verify causes all outbound pycurl requests to run with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0, exposing pyLoad to man-in-the-middle attacks against every fetched hostname.
Affected Products
- pyLoad versions prior to 0.5.0b3.dev100
- pyload-ng distributions on Python
- Deployments exposing the pyLoad API to authenticated non-admin users with the SETTINGS permission
Discovery Timeline
- 2026-05-11 - CVE-2026-42312 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-42312
Vulnerability Analysis
The set_config_value() API method enforces authorization through the @permission(Perms.SETTINGS) decorator. Beyond that decorator, it relies on the static ADMIN_ONLY_CORE_OPTIONS allowlist to restrict which configuration keys require administrator privileges. The ("general", "ssl_verify") key was never added to that list. As a result, the non-admin SETTINGS role can mutate a setting that governs TLS verification for the entire process.
When general.ssl_verify is set to off, pyLoad initializes pycurl handles with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0. Every subsequent outbound HTTPS request accepts arbitrary certificates for arbitrary hostnames. This is a direct continuation of the fix family that includes CVE-2026-33509, CVE-2026-35463, CVE-2026-35464, and CVE-2026-35586, each of which patched a different missed option in the same allowlist.
Root Cause
The root cause is an incomplete denylist/allowlist pattern. Security-sensitive options are protected only when explicitly enumerated in ADMIN_ONLY_CORE_OPTIONS. The pattern is fragile: every new sensitive option must be remembered and added by hand. Missing entries silently downgrade authorization checks, which is how ssl_verify slipped through.
Attack Vector
An attacker first obtains credentials for any pyLoad account holding the SETTINGS permission. The attacker calls set_config_value("general", "ssl_verify", "off") over the API. With TLS verification disabled, an on-path attacker between pyLoad and remote download targets can present forged certificates. The attacker can then intercept, modify, or redirect downloaded files and any credentials passed in fetched URLs.
No verified exploit code is publicly available. See the GitHub Security Advisory GHSA-ccxc-x975-4hh9 for additional technical detail.
Detection Methods for CVE-2026-42312
Indicators of Compromise
- API requests invoking set_config_value with the parameters general and ssl_verify from non-administrator accounts
- pyLoad configuration files showing ssl_verify = false or ssl_verify = off under the [general] section
- Outbound HTTPS sessions from pyLoad hosts accepting certificates that fail standard validation
Detection Strategies
- Audit pyLoad access logs for set_config_value calls and correlate the calling user against admin roles
- Monitor for changes to the pyLoad configuration file on disk and alert on modifications to TLS-related keys
- Inspect TLS sessions originating from pyLoad hosts for certificates not chaining to trusted roots
Monitoring Recommendations
- Enable verbose API logging on the pyLoad service and forward events to a centralized log platform
- Track all accounts assigned the SETTINGS permission and review the assignment regularly
- Alert on any runtime configuration change that disables certificate or hostname verification across managed services
How to Mitigate CVE-2026-42312
Immediate Actions Required
- Upgrade pyLoad to version 0.5.0b3.dev100 or later, which adds ssl_verify to the admin-only allowlist
- Audit current configuration and reset general.ssl_verify to true if it has been disabled
- Review all non-admin accounts holding the SETTINGS permission and revoke where unnecessary
Patch Information
The vendor fix is published in pyLoad 0.5.0b3.dev100. The patch extends ADMIN_ONLY_CORE_OPTIONS in src/pyload/core/api/__init__.py so that set_config_value() rejects attempts to change ("general", "ssl_verify") unless the caller is an administrator. Details are available in the pyLoad Security Advisory GHSA-ccxc-x975-4hh9.
Workarounds
- Restrict the pyLoad web API to trusted networks using a reverse proxy or firewall
- Limit the SETTINGS permission to administrator accounts only until the upgrade is applied
- Enforce file-system permissions on the pyLoad configuration to prevent runtime tampering by service accounts
# Upgrade pyload-ng to the patched release
pip install --upgrade 'pyload-ng>=0.5.0b3.dev100'
# Verify ssl_verify is enabled in the active configuration
grep -E '^\s*ssl_verify' ~/.pyload/settings/pyload.cfg
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
