The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses
    HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account
    when matching stored credentials against a requested URL. Credentials added for an https:// URL were also
    used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to
    plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials
    in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching
    is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for
    requests with the same scheme. Credentials registered with a bare authority (such as example.com or
    example.com:8080) continue to match any scheme, preserving compatibility with existing code, including
    proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications
    never make plain http:// requests to hosts for which credentials are registered, for example by not
    following redirects to http:// URLs. (CVE-2026-15806)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4411-1 advisory.

    - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of     service via high       CPU usage (bsc#1273148).
    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme     (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during     dialect       sniffing and consume significant CPU (bsc#1274683).
    - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the     destination for       members whose name leaves the destination and retu (bsc#1276227).

    Changes for python:

    - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4396-1 advisory.

    - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
    - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
    - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another       scheme (bsc#1276223).
    - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0     (bsc#1276226).
    - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the     destination for       members whose name leaves the destination and retu (bsc#1276227).

    Changes for python311:

    - Update to version 3.11.16.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790238098 advisory.

  - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses     HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account     when matching stored credentials against a requested URL. Credentials added for an https:// URL were also     used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to     plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials     in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching     is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for     requests with the same scheme. Credentials registered with a bare authority (such as example.com or     example.com:8080) continue to match any scheme, preserving compatibility with existing code, including     proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications     never make plain http:// requests to hosts for which credentials are registered, for example by not     following redirects to http:// URLs. (CVE-2026-15806)

  - unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input     containing long runs of combining characters with alternating Canonical Combining Class values. This     affects all normalization forms. (CVE-2026-3276)

  - tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or     directory-like names, to redirect later archive members outside the intended extraction directory. This     allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination     directory, subject to the permissions of the extracting process. (CVE-2026-7774)

  - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to     crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify     the permissions or modification time of a file outside the destination directory, or expose the contents     of that file within the extracted tree. (CVE-2026-82049)

  - The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was     patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]),     ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to     target.sendport(). This patch is related to CVE-2021-4189. (CVE-2026-8328)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses     HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account     when matching stored credentials against a requested URL. Credentials added for an https:// URL were also     used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to     plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials     in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching     is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for     requests with the same scheme. Credentials registered with a bare authority (such as example.com or     example.com:8080) continue to match any scheme, preserving compatibility with existing code, including     proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications     never make plain http:// requests to hosts for which credentials are registered, for example by not     following redirects to http:// URLs. (CVE-2026-15806)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463923	Echo: python3.13: security update to 3.13.5-2+e33	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463923	Echo: python3.13: security update to 3.13.5-2+e33	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
362580	SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:4411-1)	Nessus	SuSE Local Security Checks	Local	high
362494	SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:4396-1)	Nessus	SuSE Local Security Checks	Local	high
359892	AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790238098)	Nessus	Alma Linux Local Security Checks	Local	high
338038	Linux Distros Unpatched Vulnerability : CVE-2026-15806	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-15806

medium

Tenable Plugins

medium

medium

high

high

high

medium