high 8.1

CVE-2026-9323 json

Insecure PRNG and Information Exposure in urwid Web Display Backend

published 2026-07-18 3 mo ago modified 2026-11-08 20 h ago also EUVD-2026-45381

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits: 0; none known

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim's terminal screen via the polling endpoint, inject keystrokes into the victim's session (yielding OS-level code execution with the session owner's privileges if the session runs a shell), and inject exit sequences or flood the FIFO to terminate or crash the session. A prior Bandit S311 warning on this usage was suppressed with # noqa: S311 rather than fixed

Patch / fix

distros 7 links 2

debian ubuntu red hat suse opensuse almalinux rocky linux

urwid Debian 12 2.1.2-4+deb12u1
urwid Debian 14 4.1.3-1

debian advisories DEBIAN-CVE-2026-9323

urwid Ubuntu 22.04 LTS 2.1.2-2ubuntu0.1
urwid Ubuntu Pro 18.04 LTS 2.0.1-2ubuntu0.1~esm1
urwid Ubuntu Pro 20.04 LTS 2.0.1-3ubuntu0.1~esm1
urwid Ubuntu Pro 26.04 LTS 3.0.4-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-9323

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-urwid RHEL 9 2.1.2-4.el9_8.1
python3-urwid RHEL 9 2.1.2-4.el9_8.1
python-urwid RHEL 8 1.3.1-5.el8_10
python3-urwid RHEL 8 1.3.1-5.el8_10
python-urwid RHEL 10.2 2.5.3-4.el10_2.5
python3-urwid RHEL 10.2 2.5.3-4.el10_2.5
python-urwid enterprise linux eus 10.0 2.5.3-4.el10_0.5
python3-urwid enterprise linux eus 10.0 2.5.3-4.el10_0.5

red hat advisories RHSA-2026:60353 RHSA-2026:59198 RHSA-2026:58955 RHSA-2026:58953 RHSA-2026:58954 RHSA-2026:58952

python-urwid SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.0.1-150000.3.3.1
python-urwid SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.1.2-150400.11.6.1

suse advisories SUSE-SU-2026:3460-1 SUSE-SU-2026:3425-1

python-urwid openSUSE Tumbleweed 4.0.5-1.1

opensuse advisories openSUSE-SU-2026:11356-1

python3-urwid AlmaLinux 10 2.5.3-4.el10_2.5
python3-urwid AlmaLinux 8 1.3.1-5.el8_10
python3-urwid AlmaLinux 9 2.1.2-4.el9_8.1

almalinux advisories ALSA-2026:58561 ALSA-2026:58562 ALSA-2026:58952

python-urwid Rocky Linux 9 2.1.2-4.el9_8.1
python-urwid Rocky Linux 10 2.5.3-4.el10_2.5
python-urwid Rocky Linux 8 1.3.1-5.el8_10

rocky linux advisories RLSA-2026:58952 RLSA-2026:58561 RLSA-2026:58562

github.com/urwid/urwid@24acd12 commit
github.com/urwid/urwid#1128 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-9323 updated 2026-11-05 cvss 8.1

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

Red Hat Enterprise Linux 6 python-urwid Red Hat Enterprise Linux 7 python-urwid
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux BaseOS (v. 8) python-urwid 1.3.1-5.el8_10, python3-urwid 1.3.1-5.el8_10
fixed: vendor fix RHSA-2026:58562
Red Hat Enterprise Linux BaseOS (v. 9) python-urwid 2.1.2-4.el9_8.1, python3-urwid 2.1.2-4.el9_8.1
fixed: vendor fix RHSA-2026:58952
Red Hat Enterprise Linux BaseOS (v. 10) python-urwid 2.5.3-4.el10_2.5, python3-urwid 2.5.3-4.el10_2.5
fixed: vendor fix RHSA-2026:58561
Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-urwid 1.3.1-4.el8_4.1, python3-urwid 1.3.1-4.el8_4.1
fixed: vendor fix RHSA-2026:57638
Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-urwid 1.3.1-4.el8_6.1, python3-urwid 1.3.1-4.el8_6.1
fixed: vendor fix RHSA-2026:59198
Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-urwid 1.3.1-4.el8_8.1, python3-urwid 1.3.1-4.el8_8.1
fixed: vendor fix RHSA-2026:57637
Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-urwid 2.1.2-4.el9_2.1, python3-urwid 2.1.2-4.el9_2.1
fixed: vendor fix RHSA-2026:58954

show 6 more

Red Hat Enterprise Linux BaseOS E4S (v.9.4) python-urwid 2.1.2-4.el9_4.1, python3-urwid 2.1.2-4.el9_4.1
fixed: vendor fix RHSA-2026:58953
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python-urwid 2.5.3-4.el10_0.5, python3-urwid 2.5.3-4.el10_0.5
fixed: vendor fix RHSA-2026:60353
Red Hat Enterprise Linux BaseOS EUS (v.9.6) python-urwid 2.1.2-4.el9_6.1, python3-urwid 2.1.2-4.el9_6.1
fixed: vendor fix RHSA-2026:58955
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-urwid 1.3.1-4.el8_4.1, python3-urwid 1.3.1-4.el8_4.1
fixed: vendor fix RHSA-2026:57638
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) python-urwid 1.3.1-4.el8_6.1, python3-urwid 1.3.1-4.el8_6.1
fixed: vendor fix RHSA-2026:59198
Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-urwid 1.3.1-4.el8_8.1, python3-urwid 1.3.1-4.el8_8.1
fixed: vendor fix RHSA-2026:57637

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-07-20)

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.2	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	4.0	9.2	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

urwid urwid

Classification

Weakness

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

References

github.com /urwid/urwid/commit/24acd12f0d0598036d0d577f2ee63e4a27b4a3d9
patch
github.com /urwid/urwid/pull/1128
issue-tracking, patch
github.com /urwid/urwid/security/advisories/GHSA-rjwp-g85x-gmjv
vendor-advisory
github.com /urwid/urwid
product
github.com /urwid/urwid/issues/1127
issue-tracking
vulncheck.com /advisories/insecure-prng-and-information-exposure-in-urwid-web-display-backend
third-party-advisory
lists.debian.org /debian-lts-announce/2026/09/msg00015.html

Sources

CVE List CVE-2026-9323
NVD CVE-2026-9323

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary