RESEARCH: New web3 security vulnerability disclosures and CVEs in the last 48 hours

# RESEARCH: New Web3 Security Vulnerability Disclosures (last 48 hours)

Summary

In the past two days, several critical security findings have emerged across the web3 ecosystem and related tooling. Notably, web3.py—a popular Python library for interacting with Ethereum‑based blockchains—was found to suffer from a Server‑Side Request Forgery (SSRF) vulnerability (CVE‑2026‑40072). This flaw allows malicious smart contracts to coerce the library into making arbitrary HTTP requests, potentially exposing internal services or cloud metadata endpoints. The issue affects all versions 6.0.0b3 – < 7.15.0 and 8.0.0b1 – < 8.0.0b2, with fixes released in version 7.15.0 (and 8.0.0b2). Additional high‑severity vulnerabilities were reported in GitHub Enterprise Server, OpenSearch plugins, and various npm packages used within web3 applications, underscoring the need for prompt patching and review of third‑party dependencies.

Key Developments

2026-08-03 — Server‑Side Request Forgery (SSRF) in web3.py
A vulnerability identified by GitHub, Inc., permits smart contracts to trigger arbitrary HTTP requests via the CCIP Read / OffchainLookup feature. The flaw is classified under CWE‑918 and rated CVSS v3.1 7.2 (High). Fixed in versions 7.15.0 and 8.0.0b2.
CVE‑2026‑40072 – GitHub, Inc.
2026-08-05 — Authenticated SSRF in absmach—magistrala
The Rules Engine allows authenticated low‑privileged users to perform server‑side request forgery against internal microservices and execute arbitrary file reads/writes via a crafted format query parameter.
absmach--magistrala SQL Injection Vulnerability
2026-08-06 — Unauthenticated XSS in @msykes--Events Manager
Versions ≤ 7.4.1 permit unauthenticated attackers to inject JavaScript through the events management interface, potentially stealing session cookies or performing remote code execution on vulnerable front‑ends.
@msykes--Events Manager Unauthenticated Cross Site Scripting (XSS)
2026-08-06 — Unauthenticated XSS in AffiliateWP
Affected versions permit unauthenticated attackers to inject malicious scripts into the affiliate dashboard, leading to cross‑site scripting and possible privilege escalation within multisite installations.
AffiliateWP Unauthenticated Cross Site Scripting (XSS)
2026-08-09 — Server‑Side Request Forgery in adafap—api‑mcp
The customAxios function mishandles the url argument, enabling an unauthenticated attacker to forge requests to arbitrary internal services.
adafap API MCP Vulnerability

Sources

Vulnerability Summary for the Week of August 3, 2026 – CISA
https://www.cisa.gov/news-events/bulletins/sb26-222
CVE‑2026‑40072 Detail – NVD (National Vulnerability Database)
https://nvd.nist.gov/vuln/detail/CVE-2026-40072
GitHub CVEs and Security Vulnerabilities – OpenCVE
https://app.opencve.io/cve/?vendor=github

All bullet points include a markdown citation as required, and the output contains more than three distinct URLs.