Python.org download metadata API authentication bypass fixed
A critical authentication bypass vulnerability in the python.org release management API, reported on February 23rd, 2026, has been mitigated. This flaw would have allowed an attacker to modify Python release and file metadata, potentially affecting download URLs. While no exploitation has been detected, the fix ensures API requests are processed with correct privileges and hardens URL validation. The patch was developed and deployed within 48 hours of the report, followed by extensive auditing and third-party review.
- →API authentication bypass vulnerability in python.org download metadata fixed
- →Additional hardening applied to URL validation and logging
- →Third-party audit and LLM analysis conducted
Security (1) ›
- API authentication bypass vulnerability in python.org download metadata fixed
An authentication bypass vulnerability in the python.org release management API allowed an attacker to process requests with admin privileges by supplying an arbitrary API key with an admin username. This could have led to modification of Python release and file metadata, specifically the URLs offered for download and verification materials. The issue was reported on February 23rd, 2026, and a patch was deployed within 48 hours, with subsequent audits confirming no evidence of exploitation. The vulnerability had existed in the codebase since 2014.
Enhancements (1) ›
- Additional hardening applied to URL validation and logging
The codebase was manually audited, and additional hardening was applied to prevent the circumvention of authentication or authorization. Specifically, the database and API now reject URLs that do not start with "https://www.python.org/". Logging retention for requests to python.org was also increased from 3 days to 30 days to aid in future audit work.
Maintenance (1) ›
- Third-party audit and LLM analysis conducted
A third-party audit was performed by Trail of Bits, improving functionality to require HTTPS URLs for newer releases through a custom field validator. Additionally, LLM auditing tools were used to scan the codebase, which did not find additional issues related to authentication or authorization. Enhanced test cases for negative authentication branches were also added.
https://blog.python.org/2026/06/mitigated-api-bypass-for-download-metadata-python-dot-org/