Read the docs
TI-2026-21021 Aliases CVE-2026-26007GHSA-r6ph-v2qm-q3c2

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Priority LOW 36CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 26 fixed, 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.

Summary

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Partial cryptography (pyca): 46.0.5cryptography (PyPI): 46.0.5Red Hat: 24 advisoriesRed Hat: 26 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pycacryptographybefore 46.0.546.0.5Patch availableCNA
—cryptography (PyPI)before 46.0.546.0.5Patch availableGHSA-r6ph-v2qm-q3c2
  • cryptography Vendorpyca Affected before 46.0.5 Fixed in 46.0.5 Patch available CNA
  • cryptography (PyPI) Vendor— Affected before 46.0.5 Fixed in 46.0.5 Patch available GHSA-r6ph-v2qm-q3c2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*before 46.0.5VulnerableCryptography.io
  • cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:* Versions before 46.0.5 Vulnerable ·Cryptography.io

Remediation

  • Fix · CNA cryptography (pyca) Fixed in 46.0.5
  • Fix · GHSA-r6ph-v2qm-q3c2 cryptography (PyPI) Fixed in 46.0.5 Advisory →

Red Hat 24 advisories

  • RHSA-2026:95346 Released 2026-11-06 · Red Hat rating Critical
    OpenShift Container Platform 4.22.22 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202611032353-0, rhcos-ppc64le-4.22.9.8.202611032353-0, rhcos-s390x-4.22.9.8.202611032353-0 +1
  • RHSA-2026:92574 Released 2026-10-29 · Red Hat rating Important
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
Show 21 more Red Hat advisories
  • RHSA-2026:22993 Released 2026-06-03 · Red Hat rating Important
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:22330 Released 2026-06-01 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.21, fence-agents-common-4.10.0-43.el9_2.21, fence-agents-compute-4.10.0-43.el9_2.21 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.21, fence-agents-all-4.10.0-43.el9_2.21, fence-agents-amt-ws-4.10.0-43.el9_2.21 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.21, fence-agents-all-4.10.0-43.el9_2.21, fence-agents-amt-ws-4.10.0-43.el9_2.21 +39
  • RHSA-2026:21517 Released 2026-05-28 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) fence-agents-4.10.0-62.el9_4.24, fence-agents-common-4.10.0-62.el9_4.24, fence-agents-compute-4.10.0-62.el9_4.24 +11
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.24, fence-agents-all-4.10.0-62.el9_4.24, fence-agents-amt-ws-4.10.0-62.el9_4.24 +40
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.24, fence-agents-all-4.10.0-62.el9_4.24, fence-agents-amt-ws-4.10.0-62.el9_4.24 +39
  • RHSA-2026:21431 Released 2026-05-27 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.16, fence-agents-aliyun-4.10.0-86.el9_6.16, fence-agents-all-4.10.0-86.el9_6.16 +47
  • RHSA-2026:19355 Released 2026-05-19 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-110.el9_8.2, fence-agents-aliyun-4.10.0-110.el9_8.2, fence-agents-all-4.10.0-110.el9_8.2 +47
  • RHSA-2026:13672 Released 2026-05-05 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-98.el9_7.12, fence-agents-aliyun-4.10.0-98.el9_7.12, fence-agents-all-4.10.0-98.el9_7.12 +47
  • RHSA-2026:13553 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +2
  • RHSA-2026:13545 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
  • RHSA-2026:13512 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
  • RHSA-2026:12176 Released 2026-04-30 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.25, fence-agents-all-4.2.1-129.el8_10.25, fence-agents-amt-ws-4.2.1-129.el8_10.25 +41
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.25, fence-agents-aws-4.2.1-129.el8_10.25, fence-agents-azure-arm-4.2.1-129.el8_10.25 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.25, fence-agents-aws-4.2.1-129.el8_10.25, fence-agents-azure-arm-4.2.1-129.el8_10.25 +2
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:7295 Released 2026-04-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images python-cryptography-46.0.7-1.hum1@src
  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6567 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6497 Released 2026-04-02 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:6404 Released 2026-04-01 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
  • RHSA-2026:6309 Released 2026-03-31 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
  • RHSA-2026:6308 Released 2026-03-31 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
  • RHSA-2026:5665 Released 2026-03-24 · Red Hat rating Important
    Red Hat Quay 3.10.19
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:5168 Released 2026-03-19 · Red Hat rating Important
    Red Hat Quay 3.9.19
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2694 Released 2026-02-12 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:13553, RHSA-2026:6308
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:13512
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:13512
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:13545, RHSA-2026:6309
Red Hat Discovery 2Fixed RHSA-2026:2694
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:12176
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:13672, RHSA-2026:19355
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:22330
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:21517
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:21431
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:22330
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2026:21517
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:12176
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:22330
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2026:21517
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:12176
Red Hat Hardened ImagesFixed RHSA-2026:7295
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184
Red Hat OpenShift AI 3.4Fixed RHSA-2026:92510
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:95346
Red Hat Quay 3.10Fixed RHSA-2026:5665
Red Hat Quay 3.15Fixed RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2026:6497, RHSA-2026:6567
Red Hat Quay 3.9Fixed RHSA-2026:5168
Red Hat Satellite 6.18Fixed RHSA-2026:22993
Red Hat Satellite 6.19Fixed RHSA-2026:92574
Not affected: 32 products
  • Ansible Automation Orchestrator 2026
  • Confidential Compute Attestation
  • Lightspeed Core
  • Lightspeed Services for Advanced Cluster Management
  • OpenShift Lightspeed
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat AI Inference Server
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform Ansible Core 2
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Enterprise Linux command line assistant
  • Red Hat Hardened Images
  • Red Hat Lightspeed Services for OCP
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3.10
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • Red Hat Trusted Artifact Signer

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26007
  2. 2026-10-03 Alias added: GHSA-r6ph-v2qm-q3c2
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-20 Affected versions changed · Red Hat
  5. 2026-10-21 Affected versions changed · Red Hat
  6. 2026-10-23 Affected versions changed · Red Hat
  7. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  8. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  9. 2026-10-30 Affected versions changed · Red Hat
  10. 2026-10-30 Fix available: Red Hat Satellite 6.19 · Red Hat
  11. 2026-10-31 Fix available: RHSA-2026:92574 · Red Hat
  12. 2026-11-05 Affected versions changed · Red Hat
  13. 2026-11-06 Affected versions changed · Red Hat
  14. 2026-11-06 Affected versions changed · Red Hat
  15. 2026-11-07 Fix available: RHSA-2026:95346 · Red Hat
  16. 2026-11-07 Fix available: Red Hat OpenShift Container Platform 4.22 · Red Hat

References

Patch 1

Advisory 3

Other 2

  • TI-2026-48588 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVSS 4.0HIGH 8.7
  • TI-2026-48587 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVSS 4.0MEDIUM 6.9
  • TI-2026-48586 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences