What is CVE-2026-41205?
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.
Timeline
- 2026-04-23Published to the U.S. National Vulnerability Database (NVD)
- 2026-06-17NVD record last updated
Affected product
Sqlalchemy Mako
Remediation Steps
- Inventory all exposed Rockwell Automation PLC devices connected to internet or corporate network
- Apply manufacturer security patches immediately to air-gapped or segmented instances
- Implement network segmentation to isolate PLCs from internet-facing systems
- Deploy industrial network monitoring to detect unauthorized PLC enumeration or configuration changes
- Coordinate with facility operations to validate patch compatibility before production deployment
References
- https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm
- https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3
- https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11
- https://www.cisa.gov/news-events/alerts/2026/04/07
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-099-01.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-41205
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 2 of April 2026 (April 13 – 19)
Browse all tracked CVEs in the defend.network CVE database →
🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.