Vulnerability in streamlink (CVE-2026-92164)
Summary
Vulnerability in streamlink (CVE-2026-92164). Confidential information can be exposed externally. Exploitable via HTTPSession. Mitigation: upgrade to 8.6.0 or later.
Original description
The description as published by the source.
Summary
HTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handling
unchanged from requests.Session. requests does not check for scheme downgrades or
cross-protocol transitions when it follows a redirect, so any http(s) request Streamlink makes can
be redirected by the remote server into file:///... and the local file is returned as the
response body.
GHSA-hgqw-6m45-hw5f / CVE-2026-44353 fixed direct file:// segment and playlist URIs in HLS
playlists and DASH manifests. Those checks look at the URL as it appears in the manifest, so a
manifest that lists an ordinary https:// URL passes them, and the redirect happens later at fetch
time. The attack surface is the same one that advisory describes, but the flaw is one level down in
HTTPSession rather than in the streaming implementations, so it applies to every request the
session makes and not only to segment and manifest fetches.
Affected version
Executed against released streamlink 8.5.0 (PyPI, installed into a clean venv on
Python 3.12).
Attacker model
The attacker controls a URL the victim's Streamlink run reaches: a playlist or manifest URL passed
on the command line, or any http(s) URL referenced from attacker-controlled manifest content. No
privileges on the victim host and no file:// input are required, and the file:// scheme never
appears in anything the victim or the manifest parser sees.
Proof of concept, executed
import threading
fro…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-92164 has been found in streamlink.
Attackers can target a specific entry point like HTTPSession over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 6.5/10.
What to do: upgrade streamlink to 8.6.0 or later.
If unsure, ask your IT team or search "streamlink CVE-2026-92164" on the vendor's site.
CVE-2026-92164 (streamlink) — CWE-73 / CVSS v3 6.5
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: HTTPSession / FileAdapter / requests.Session / requests
Patched: 8.6.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-73) exists in streamlink. Attackers reach the vulnerable code path via HTTPSession without authentication.
Check the vendor advisory for the affected versions of streamlink. Attack surface: HTTPSession / FileAdapter / requests.Session / requests.
Severity: Medium (CVSS 6.5/10). Confidential information can be exposed externally.
Update to 8.6.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'streamlink' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'streamlink' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
streamlinkを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade streamlink to 8.6.0ステージング環境で 8.6.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-92164 streamlink
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- package pypi.org
- web github.com
- web github.com
- web github.com