Vulnerability PYSEC-2026-2391
Low Risk
LOW RISK
CVSS Score: 3.1
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
3 months ago
July 13, 2026 at 03:46 PM UTC
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
2.0.0 - 2.8.4.7578rc0
2.0.0 - 2.8.4.7578rc0
Summary
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
Details
The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
10 hours ago
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction
2.3.1 - 2.8.6 GHSA-xpf3-p7gm-7756
2.3.1 - 2.8.6 GHSA-xpf3-p7gm-7756
Medium Risk
3 months ago
BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
2.3.1 - 2.8.4.7578rc0 PYSEC-2026-2392
2.3.1 - 2.8.4.7578rc0 PYSEC-2026-2392
Medium Risk
3 months ago
BBOT: Arbitrary File Write in postman_download Module
2.1.0 - 2.8.5 PYSEC-2026-2393
2.1.0 - 2.8.5 PYSEC-2026-2393
Low Risk
3 months ago
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2394
2.0.0 - 2.8.4.7578rc0 PYSEC-2026-2394
Low Risk
3 months ago
No summary available
2.3.1 - 2.8.6 PYSEC-2026-3719
2.3.1 - 2.8.6 PYSEC-2026-3719
Impacted packages
Timeline
Published
3 months ago
July 13, 2026 at 03:46 PM UTC
Fixed (2.8.5)
4 months ago
June 16, 2026 at 10:58 PM UTC
Last Modified
3 months ago
July 13, 2026 at 04:31 PM UTC