Requests‑hardened is a library that overrides the Python requests library to add security features. Earlier releases do not block IP addresses within the RFC 6598 Shared Address Space (100.64.0.0/10). If an attacker can provide arbitrary URLs to the library, the SSRF protection is bypassed, enabling the attacker to reach internal services on that CIDR. The result is unintended access to internal resources, potentially exposing sensitive data and allowing further lateral movement. This weakness is classified as CWE‑918.

Vendor: Saleor; product: requests‑hardened. The vulnerability affects installations that use a version of the library built before the fix. The bug was addressed in version 1.2.1; earlier releases remain vulnerable. No other vendor or product variants are listed.

The CVSS score is 6.5, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can supply URLs to the library—such as external users of a web application that uses requests‑hardened—might exploit the bypass to reach internal network resources. The attack requires that the target environment employs the 100.64.0.0/10 CIDR for pod networking or other internal services, a pattern common in AWS EKS clusters and similar deployments. The impact is therefore environment‑dependent, providing unintended internal access where the CIDR is used.