CVE-2026-78682: NLTK SSRF Vulnerability via HTTP Proxy

CVE-2026-78682 Overview

CVE-2026-78682 is a server-side request forgery (SSRF) vulnerability [CWE-918] in the Natural Language Toolkit (NLTK) library before version 3.10.3. The flaw resides in nltk.pathsec.urlopen and its callers nltk.data.load and nltk.downloader.Downloader.index/download. When an HTTP proxy is configured, NLTK's hostname validation is bypassed because proxy-handler inheritance disables the library's safe HTTP and HTTPS handlers. Attackers can supply a validated public URL that the proxy forwards to an internal loopback-only service.

Critical Impact
Attackers can disclose internal HTTP resources, load forged downloader indexes, and install attacker-chosen package content on hosts running NLTK behind a proxy.

Affected Products

NLTK (Natural Language Toolkit) versions prior to 3.10.3
Python applications using nltk.data.load with proxy configuration
Python applications using nltk.downloader.Downloader.index or download methods behind an HTTP proxy

Discovery Timeline

2026-08-25 - CVE-2026-78682 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-78682

Vulnerability Analysis

The vulnerability lies in the interaction between NLTK's URL validation logic and Python's urllib proxy handling. The function nltk.pathsec.urlopen validates the requested hostname locally to enforce an allowlist of safe destinations. This local validation confirms that the supplied URL points to a public, non-internal host.

However, when an HTTP proxy is configured, urllib installs proxy handlers that override the safe HTTP and HTTPS handlers NLTK relies on. The actual fetch is performed by the proxy against the target host, and the proxy never re-validates the destination. An attacker who controls the URL input can supply a validated public hostname that the proxy resolves and forwards to an internal loopback-only service such as 127.0.0.1 or a cloud metadata endpoint.

Because nltk.downloader.Downloader.index and download use the same primitive, an attacker can also serve a forged package index. This causes NLTK to install attacker-chosen package content, escalating SSRF into supply-chain compromise.

Root Cause

The root cause is a validation-versus-fetch mismatch. NLTK validates the URL locally before dispatch, but Python's proxy-handler inheritance disables the safe handlers that would enforce the validation at fetch time. The proxy becomes the effective client and honors the requested destination without applying NLTK's allowlist.

Attack Vector

Exploitation requires no authentication and no user interaction. The attacker needs the ability to influence a URL, package identifier, or downloader index argument passed to NLTK on a host that has an HTTP proxy configured. Refer to the GitHub Security Advisory GHSA-6ww7-3frv-cqxh and the VulnCheck Advisory on SSRF Bypass for the technical write-up.

No verified public exploit code is available. The vulnerability mechanism is described in prose in the referenced advisories.

Detection Methods for CVE-2026-78682

Indicators of Compromise

Outbound HTTP requests from an application host to its configured proxy carrying URLs whose resolved destination is an internal or loopback address.
Unexpected nltk.download or nltk.data.load calls referencing hostnames or resources not present in prior application baselines.
Newly created files under NLTK data directories such as ~/nltk_data/ that do not match the official package manifest.
Proxy access logs showing 200 responses for requests targeting RFC1918, 127.0.0.0/8, or cloud metadata service addresses on behalf of the NLTK user agent.

Detection Strategies

Inventory Python environments and flag installations where nltk is present at a version below 3.10.3.
Instrument the proxy tier to log the full destination URL and reject requests to internal ranges regardless of client-side validation.
Correlate NLTK process activity with proxy traffic to identify calls where the fetched hostname differs from the argument passed to nltk.data.load.

Monitoring Recommendations

Monitor proxy egress for requests originating from application accounts running NLTK to internal HTTP endpoints and cloud metadata endpoints such as 169.254.169.254.
Track modifications to NLTK data directories and hash installed corpora against known-good values.
Alert on execution of nltk.downloader when the source URL host is not the official NLTK data server.

How to Mitigate CVE-2026-78682

Immediate Actions Required

Upgrade NLTK to version 3.10.3 or later on all systems, including container images, virtual environments, and CI runners.
Audit application code for calls to nltk.data.load, nltk.downloader.Downloader.index, and nltk.downloader.Downloader.download that accept user-controlled input.
Restrict proxy access-control lists so the proxy itself refuses connections to loopback, RFC1918, and cloud metadata address ranges.

Patch Information

The vulnerability is fixed in NLTK 3.10.3. Details are published in the GitHub Security Advisory GHSA-6ww7-3frv-cqxh. Upgrade using the standard Python package manager and rebuild any container images that pin an earlier NLTK version.

Workarounds

Remove the HTTP proxy configuration for processes that invoke NLTK download or data-load functions when patching is not immediately possible.
Enforce URL allowlisting at the network egress layer so the proxy independently rejects requests to internal destinations.
Disable dynamic package downloads by pre-provisioning required NLTK corpora and setting NLTK_DATA to a read-only directory.

bash

# Configuration example
pip install --upgrade 'nltk>=3.10.3'

# Pre-provision corpora and lock the data directory
export NLTK_DATA=/opt/nltk_data
chmod -R a-w /opt/nltk_data