# python.org Release Management API Authentication Bypass (Patched, No Exploitation Confirmed)

> A decade-old authentication-confusion flaw in python.org's release management API allowed an attacker to supply an admin username paired with an arbitrary/attacker-controlled API key and have the request processed with full administrative privileges, enabling modification of Python release/file metadata and download URLs including verification-material links. Discovered by Splitline Ng (DEVCORE Research Team), reported to the Python Security Response Team (PSRT) on 2026-02-23 and patched within 24-48 hours; forensic review, an LLM-assisted audit, and a subsequent Trail of Bits third-party audit (funded by OpenAI, June 2026) all found no evidence of exploitation.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1241
- **ID:** TL-2026-1241
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

python.org's release management API is the internal tooling the Python Software Foundation (PSF) uses to publish and update release metadata and file download links shown on python.org/downloads. The API supported two authentication modes: a 'guest' (read-only/unauthenticated) mode and an 'API key' (privileged) mode intended for PSF release managers. Because the two authentication code paths were not cleanly separated, the backend could be tricked into treating a request as fully authenticated with administrator privileges simply by supplying the username of a known admin account alongside any (attacker-supplied, non-matching) API key value -- the API key value itself was never actually validated against the claimed identity in this code path. This bug had existed in the pythondotorg codebase since 2014, undetected for over a decade, and affected the metadata/download pipeline spanning Python releases 2.5 through 3.13.

Exploitation would not have allowed in-place modification of already-published release binaries, but it would have let an attacker rewrite the download URLs and verification-material URLs (PGP signature links, and Sigstore bundle links for 3.14+) surfaced on python.org/downloads. Because millions of users, CI/CD pipelines, container base images, and automated build systems fetch CPython source/binaries and their signatures directly from python.org, an attacker who chained this bug with a malicious hosting location could redirect victims toward a trojanized interpreter or tampered installer, and simultaneously redirect the corresponding signature-verification link so that naive verification steps would 'succeed' against attacker-controlled material -- a classic software supply-chain integrity attack, even though no CVE was assigned and no exploitation occurred.

DEVCORE researcher Splitline Ng reported the flaw to the PSRT on 2026-02-23. The PSRT (core responders Seth Larson, Hugo van Kemenade, and Jacob Coffee) confirmed the report the same day and shipped a fix via python/pythondotorg PR #2946 ('Delineate between the guest and API key authentication flows'), merged 2026-02-24, with DEVCORE confirming the PoC no longer worked post-patch. Follow-on hardening included PR #2947 (reject any release/file URL not beginning with https://www.python.org/) and PR #3014 (enforce HTTPS via a custom field validator for newer releases), plus extending audit-log retention from 3 to 30 days. A manual staff code audit, an LLM-assisted security audit (2026-04-23), and a Trail of Bits third-party audit of python.org and the release process (funded by OpenAI, engagement began 2026-06-01, report published 2026-06-23) all confirmed no additional authentication/authorization issues and no evidence the original flaw was ever exploited -- PGP signatures for all affected historical releases (2.5-3.13) and Sigstore attestations for 3.14+ verified cleanly against known-good artifacts.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1211 Exploitation for Stealth
- T1684.001 Impersonation
- T1606 Forge Web Credentials
- T1213 Data from Information Repositories
- T1491 Defacement
- T1565 Data Manipulation
- T1584 Compromise Infrastructure
- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1036 Masquerading
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1554 Compromise Host Software Binary
- T1102 Web Service

## Sources

- [Mitigated API authentication bypass for python.org download metadata](https://blog.python.org/2026/06/mitigated-api-bypass-for-download-metadata-python-dot-org/)
- [Python Software Foundation News: Mitigated API authentication bypass for python.org download metadata](https://pyfound.blogspot.com/2026/06/mitigated-api-bypass-for-download-metadata-python-dot-org.html)
- [Critical python.org Vulnerability Allowed Attackers to Forge Admin-Level API Requests](https://cybersecuritynews.com/critical-python-org-vulnerability/)
- [Python.org API Authentication Bypass Could Let Attackers Modify Download Metadata](https://cyberpress.org/python-org-api-authentication-bypass/)
- [Critical python.org Vulnerability Allowed Attackers to Forge Admin-Level API Requests (Cryptika mirror)](https://www.cryptika.com/critical-python-org-vulnerability-allowed-attackers-to-forge-admin-level-api-requests/)
- [python/pythondotorg PR #2946 - Delineate guest and API key authentication flows](https://github.com/python/pythondotorg/pull/2946)
- [Python Security Response Team (PSRT) charter](https://devguide.python.org/developer-workflow/psrt/)
- [PEP 811 - Defining Python Security Response Team membership and responsibilities](https://peps.python.org/pep-0811/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1241