Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pyload-ng | pip | <= 0.5.0b3.dev99 | 0.5.0b3.dev100 |
Miggo AIRoot Cause AnalysisThe vulnerability exists because of an improper authorization check in the Api.set_config_value function. The ADMIN_ONLY_CORE_OPTIONS set, which is used to restrict access to security-sensitive settings, is missing the ("general", "ssl_verify") entry. This allows any authenticated user with the SETTINGS permission to disable TLS certificate validation by setting ssl_verify to off.
The exploit chain starts when a non-admin user makes an API call to set_config_value to change this setting. Later, when pyload needs to make an outbound HTTPS request, the RequestFactory.get_options function reads this malicious setting. Finally, the HttpRequest.prepare function consumes this setting and disables pycurl's SSL_VERIFYPEER and SSL_VERIFYHOST options, making the connection vulnerable to a Man-in-the-Middle (MITM) attack. An attacker can then intercept the traffic and present a forged certificate, which pyload would accept.
