A vulnerability categorized as critical has been discovered in Ethereum web3.py up to 7.14.x/8.0.0b1. This affects the function
eth_call/call of the component Backend Service. Executing a manipulation of the argument offchain_lookup_payload[“urls”] can lead to server-side request forgery.
The identification of this vulnerability is CVE-2026-40072. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
