Vulnerability Details CVE-2026-58501
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fixed in version 4.3.3.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 16.5%
CVSS Severity
CVSS v3 Score 5.9
References
Products affected by CVE-2026-58501
-
cpe:2.3:a:python-zeep:zeep:4.0.0
-
cpe:2.3:a:python-zeep:zeep:4.1.0
-
cpe:2.3:a:python-zeep:zeep:4.2.0
-
cpe:2.3:a:python-zeep:zeep:4.2.1
-
cpe:2.3:a:python-zeep:zeep:4.3.0
-
cpe:2.3:a:python-zeep:zeep:4.3.1
-
cpe:2.3:a:python-zeep:zeep:4.3.2