Outdated cryptography dependency contains CVE-2026-26007 #956

Activity

1. devin-ai-integration commented on Apr 1, 2026

   

   devin-ai-integrationBot

   on Apr 1, 2026 – with Devin.ai Integration

   Contributor

   More actions

   Hi Yong Zheng (@MonkeyCanCode), thank you for reporting this!

   You're correct — the cryptography package is currently pinned to >=44.0.0,<45.0.0 in the CDK, and CVE-2026-26007 (CVSS 8.2 HIGH / 6.5 MEDIUM) affects all versions prior to 46.0.5.

   CVE-2026-26007 Assessment

   What it is: A missing subgroup validation flaw in elliptic curve operations (load_pem_public_key(), public_key_from_numbers(), etc.) that allows small-subgroup attacks on SECT binary elliptic curves. This can leak private key bits via ECDH or enable signature forgery via ECDSA.

   Practical impact on Airbyte connectors: The vulnerability only affects SECT binary curves, which are rarely used in real-world applications. Airbyte connectors primarily use standard NIST prime curves (P-256, P-384) for TLS and OAuth — not SECT curves. While the direct exploitation risk to Airbyte users is low, updating the dependency is still the right thing to do from a security hygiene perspective.

   Fix: cryptography >= 46.0.5

   There was a recent attempt in PR #968 to widen the cryptography range, but the change was reverted due to a compatibility issue with newer versions. The team is aware of the constraint and we've escalated this internally to ensure it gets addressed.

   I've created an internal tracking issue for this — the engineering team will evaluate unblocking the upgrade to cryptography >= 46.0.5.

   ---

   Need more help? Join Airbyte Community Slack for peer support, or if you're a Cloud customer, open a support ticket referencing this URL.
2. devin-ai-integration commented on Apr 1, 2026

   

   devin-ai-integrationBot

   on Apr 1, 2026 – with Devin.ai Integration

   Contributor

   More actions

   This issue is being tracked internally: https://github.com/airbytehq/oncall/issues/11849

   👍React with 👍1Reacted by Yong Zheng
3. pnilan commented on Jul 31, 2026

   

   Patrick Nilan (pnilan)

   on Jul 31, 2026

   Collaborator

   More actions

   This CVE has been addressed with the merging of the following PR: #975
4. Patrick Nilan (pnilan)

   closed this as completedon Jul 31, 2026
5. Patrick Nilan (pnilan)

   added

   communityPRs and issues from community contributorsPRs and issues from community contributors

   on Jul 31, 2026