CVE-2026-77401: AccessControl Package Vulnerable to Information Disclosure via Python String Formatting
Summary
CVE-2026-77401: Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Affects accesscontrol versions < 7.4. Fixed in 7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AccessControl package is a critical component of the Zope web application server, enabling fine-grained access control to Python objects. It provides mechanisms to restrict access to sensitive data and functions, ensuring that only authorized users can interact with certain parts of the application. However, a vulnerability has been identified that allows untrusted users to exploit Python's string formatting capabilities, leading to potential information disclosure.
Vulnerability Detail
The vulnerability arises from Python's string format and format_map functions, which allow a format string controlled by an attacker to access objects through attribute access and subscription. This access bypasses the intended security measures of the AccessControl package, using Python's native getattr and getitem instead of the restricted variants. As a result, sensitive information may be exposed to unauthorized users, posing a significant security risk.
How To Fix
Latest published version: 7.5.0 as of 23 Oct 2026
pip install --upgrade "accesscontrol==7.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4
This is the first release that contains the fix.
pip install --upgrade "accesscontrol==7.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no effective workaround for this vulnerability. The only recommended action is to update to the patched version of the AccessControl package.
Conclusion
The CVE-2026-77401 vulnerability in the AccessControl package poses a significant risk of information disclosure through Python's string formatting functions. It is crucial for users to update to the patched version 7.4 or later to protect their applications from potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for accesscontrol →
FAQ
CVE-2026-77401 is a vulnerability in the AccessControl package that allows information disclosure through Python's string formatting functions.
If your application allows untrusted users to execute AccessControl controlled Python code, they may exploit this vulnerability to access sensitive information.
You should immediately update your AccessControl package to version 7.4 or later to mitigate the risk associated with this vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for accesscontrol.
