CVE-2026-0864

Executive Summary

CVE-2026-0864 is a configuration injection vulnerability in Python's configparser module, affecting applications that write multi-line text values containing carriage return characters (\r) to configuration files. An attacker who can control the content of a written configuration value can inject arbitrary keys and values into the resulting file, potentially altering application behavior, introducing malicious settings, or enabling further compromise. The vulnerability carries a CVSS base score of 4.1 (Medium severity) with limited exploitability (EPSS 0.00128), and while a patch has been claimed by a single source (OSV), it remains unverified. Organizations using Python's configparser in untrusted-data scenarios should prioritize review and mitigation.

Technical Analysis

The vulnerability resides in the configparser module's write() method, which serializes configuration data into INI-style files. The flaw occurs when multi-line values contain carriage return characters (\r, ASCII 13). The write() method does not properly escape or sanitize these characters, allowing them to function as line delimiters in the output file.

How the flaw works:

• The configparser module correctly handles \n (newline) as a value continuation when reading, but the write() method's sanitization logic is incomplete — it filters \n but not \r.
• An attacker who controls a value string such as malicious\rkey=injected will cause the resulting file to contain a new logical line, breaking out of the value's key and injecting key=injected as a separate configuration entry.
• On Windows systems, \r\n is the standard line terminator, making the carriage return alone sufficient to terminate a line in most parsers, including other libraries or languages that may consume the written configuration file.

Attack surface:

• Any application that uses configparser to write user-controlled or externally-influenced values into configuration files.
• Common use cases: web applications persisting settings, CI/CD pipelines generating configs, orchestration tools writing node or service configuration, and security tools that write policy files.
• The threat model requires the attacker to influence the value being written — this can occur via direct API input, reflected user data, or upstream data processing that concatenates untrusted strings into configuration values.

CWE-74 (Improper Neutralization of Special Elements in Output): The module fails to neutralize the CR character in output, leading to injection. The impact is confined to the configuration file's integrity, but can cascade into application-level attacks if the injected keys control security-relevant behavior (e.g., authentication backends, connection strings, feature flags).

Exploitation Scenarios

Attack Chain — Configuration Injection via User-Controlled Value:

1. Reconnaissance: The attacker identifies a target web application or service that uses Python's configparser to write configuration files based on user-supplied input — for example, a settings/administration panel that permits custom key-value pairs, a multi-tenant SaaS platform that generates per-customer configs, or a DevOps tool that writes service definitions from user submissions. The attacker enumerates endpoints that accept string parameters destined for a config file write.

2. Weaponization — Crafting the Payload: The attacker constructs a malicious value: a legitimate prefix followed by \r and the injection payload. Example payload designed to be appended to a user-controlled "description" field:

   description legit\rsecure_admin=false\rallow_debug=true\r
   

   When this value is passed to configparser.ConfigParser().set(section, 'description', payload) followed by parser.write(fh), the output file contains multiple logical lines:

   [section]
   description = legit
   secure_admin = false
   allow_debug = true
   

3. Execution — Triggering the Write: The attacker submits the payload through the application's legitimate input channel (HTTP POST, API call, form submission). The application calls configparser.write() to persist the configuration. The \r characters are written verbatim, producing the injected lines on systems where the configuration is later parsed with standard line-splitting semantics (splitting on \r, \n, or \r\n).

4. Post-Exploitation: Once the application reloads the modified configuration, the injected keys take effect. The attacker can:

   • Disable authentication by injecting auth_required=false or redirecting the auth backend.
   • Modify connection strings to point to an attacker-controlled database or message queue.
   • Enable verbose logging or debug endpoints to exfiltrate sensitive data.
   • Inject a preload_module or import hook if the config drives dynamic module loading.
   • Persist the injection as a backdoor: if the config file is regenerated, the attacker re-injects via continued access to the vulnerable write path.

Realistic example — Python web framework admin panel:

# Vulnerable code in target application
from configparser import ConfigParser
config = ConfigParser()
config.read('app.ini')
config.set('server', 'description', request.form['description'])  # user-controlled
with open('app.ini', 'w') as f:
    config.write(f)

Attacker POSTs description=legit\rssl_verify=false\rdebug_endpoint=/dump\r. The written file now contains injected settings disabling TLS verification and exposing a debug endpoint.

Impact Assessment

• Business Impact: Configuration injection can lead to security control bypass, data exposure via altered settings, lateral movement if connection strings are redirected, and persistent backdooring of affected applications. The integrity of all applications relying on writing configs from untrusted data is at risk.
• Affected Systems: Python applications using configparser (all Python versions where the module has not been patched). The claimed patch (per OSV) is unverified, so all current deployments should be considered potentially vulnerable until the fix is independently confirmed.
• CVSS Analysis (Score 4.1): The Medium severity reflects that exploitation requires the ability to influence data written to a config file (non-trivial precondition). The confidentiality, integrity, and availability impacts are primarily local configuration tampering; however, cascading effects can elevate real-world severity.
• Blast Radius: Moderate-to-high in environments where:
  • Configuration files control security boundaries (auth, TLS, permissions).
  • Configs are shared across multiple services or machines.
  • Written configs are consumed by non-Python tools that split on bare \r.

Detection Guidance

Sigma Rule

title: Python Configparser CR Injection Attempt
id: 7f4c2b8e-3a9d-4c6e-bf7e-9d0a1e2f3a4b
status: experimental
description: Detects attempts to exploit CVE-2026-0864 via configuration values containing carriage return characters.
logsource:
  category: application
  product: python
detection:
  selection_config_write:
    # Application-level logging of config write operations
    event: "config_write"
  selection_cr_payload:
    value|contains: "\\r"
  condition: selection_config_write and selection_cr_payload
level: medium
tags:
  - attack.t1190
  - cve.2026.0864

YARA Rule

rule CVE_2026_0864_Configparser_CR_Injection
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects carriage return injection patterns in configparser output"
        cve = "CVE-2026-0864"
        date = "2026-01-15"
    strings:
        $cr_direct = /\x0d[^\x0d\n]*=/ 
        $cr_inline = /\r[a-zA-Z_][a-zA-Z0-9_]*\s*=/ 
        $cr_value = /=\s*[^\n]*\x0d/
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-0864 Python Configparser CR Injection Attempt"; flow:established,to_server; content:"%5cr"; http_client_body; nocase; pcre:"/\r[a-zA-Z_][a-zA-Z0-9_]*\s*=/Ui"; sid:20260864; rev:1; metadata:cve CVE-2026-0864, attack_target Python, deployment DMZ, tag config_injection;)

Elastic Detection

sequence by host.name
  [ process where process.name : "python*" and event.action == "exec" ]
  [ file where event.action == "write" and file.extension : ("ini", "conf", "cfg", "config") and /* Detect CR in file content during write */
    file.size > 0 ]
  [ process where process.name : "python*" and process.args : "*configparser*" and process.args : "*write*" ]

Note: For production logging, enable file content audits or use the FIM module with CR-detection on config files.

Splunk SPL Query

index=python sourcetype=python_log OR index=filesystem sourcetype=file_write
| where match(log_line, "\\\\r") AND match(log_line, "configparser|ConfigParser")
| table _time, host, source, user, log_line
| rex field=log_line "(\r[a-zA-Z_][a-zA-Z0-9_]*\s*=)"
| where isnotnull(linux_commands)
| stats count by host, user

Wazuh OSSEC Rule

<group name="python"><rule id="100864" level="8">
  <decoded_as>json</decoded_as>
  <field name="event">config_write</field>
  <regex>\\r[a-zA-Z_][a-zA-Z0-9_]*\s*=</regex>
  <description>CVE-2026-0864: Carriage return injection detected in configparser write operation.</description>
  <group>config_injection,python,cve2026_0864,</group>
</rule></group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims patch via OSV, not independently confirmed).

1. Immediate Mitigations:

   • Sanitize input: If you cannot patch immediately, sanitize all values before passing them to configparser.write(). Strip or replace carriage return characters: value = value.replace('\r', '') or value.replace('\r', '\\r') for escaped output.
   • Use configparser read-only paths: If your application only needs to read configs, do not write user-influenced values; serialize them to an alternative format (JSON, YAML) that safely handles control characters.
   • Restrict write access: Ensure only trusted, authenticated processes can trigger config file writes. Apply least-privilege permissions to config file directories.
   • Validate after write: After writing a config file, re-read it with configparser and assert that no unexpected keys exist. Reject/rollback if injection is detected.

2. Patch/Upgrade Steps:

   • Verify the OSV-claimed patch: track the Python issue and configparser release notes for a fix that neutralizes \r in output.
   • Upgrade Python and configparser to the latest patched version once commercially confirmed. Test your application against a regression suite that includes CR-injection payloads.
   • If the vendor patch is unavailable, apply the code-level workaround above (input sanitization) as an interim solution.

3. Long-Term Hardening:

   • Code review: Audit all code paths that call configparser.write() to confirm input flows are sanitized.
   • Input validation framework: Implement centralized validation for all data that flows into file-writing operations, not just configparser.
   • Defense in depth: Monitor config file writes and compare against baseline checksums; alert on unexpected changes.
   • Runtime protections: Use a WAF or RASP (Runtime Application Self-Protection) to block CR/LF traversal in HTTP parameters destined for config write operations.
   • Update supply chain: Confirm your Python distribution vendors a patched configparser; track CVE-2026-0864 in your SBOM and CI/CD scanning pipeline.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-0864 — Official CVE record and description.
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-0864 — Single source claiming patch status; track for independent confirmation.
3. MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application (reconnaissance/initial access vector).
4. CWE-74 Reference: https://cwe.mitre.org/data/definitions/74.html — Improper Neutralization of Special Elements in Output (basis of vulnerability class).
5. CISA KEV: Not listed (as of this report) — no known exploitation in the wild per KEV; EPSS percentile 2.8% indicates low immediate risk.

Threat Actor Activity: No known threat actor campaigns or exploitation-in-the-wild evidence as of publication. The low EPSS score and absence of public PoC suggest limited active exploitation; however, the vulnerability is trivially discoverable via code audit, and exploitation may increase once a patch is confirmed and details are more widely disseminated.