Is CVE-2026-26007 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26007 being exploited in the wild.

How severe is CVE-2026-26007?

Medium severity, with a CVSS score of 6.5, published 10 February 2026.

Which products and versions are affected?

cryptography (PyPI) ECOSYSTEM:introduced=0,fixed=46.0.5.

Is there a fix for CVE-2026-26007?

Yes. cryptography (PyPI): upgrade to 46.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26007 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26007?

Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26007: PyCA cryptography missing subgroup validation in SECT curves

CVE-2026-26007 · Severity: medium · CVSS 6.5 · Published 2026-02-10

The PyCA cryptography library, a widely used tool for securing Python applications, failed to properly validate certain types of security keys. This flaw could allow an attacker to trick a system into using a weak key, potentially revealing parts of a private encryption key or allowing the forgery of digital signatures. While the issue primarily affects less common 'binary' elliptic curves, it poses a risk to data confidentiality and the integrity of secure communications.

Technologies: cryptography (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-26007 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26007 being exploited in the wild.
How severe is CVE-2026-26007?: Medium severity, with a CVSS score of 6.5, published 10 February 2026.
Which products and versions are affected?: cryptography (PyPI) ECOSYSTEM:introduced=0,fixed=46.0.5.
Is there a fix for CVE-2026-26007?: Yes. cryptography (PyPI): upgrade to 46.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26007 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-26007?: Check whether you run cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

cryptography (PyPI): upgrade to 46.0.5 or later
```
pip install "cryptography>=46.0.5"
```

Technical details

The vulnerability exists in the public_key_from_numbers, load_der_public_key, and load_pem_public_key functions of the PyCA cryptography library. These functions fail to verify that a provided public key point belongs to the expected prime-order subgroup of the curve, specifically affecting SECT (binary) curves with a cofactor greater than 1. An attacker can provide a point from a small-order subgroup to perform a subgroup attack. In ECDH key exchange, this can leak the least significant bits of the victim's private key (private_key mod small_subgroup_order). In ECDSA, it allows for the forgery of signatures. The issue is resolved in version 46.0.5 by implementing mandatory subgroup validation for curves with cofactor > 1.

Affected products

PyCA cryptography < 46.0.5
Red Hat Red Hat Enterprise Linux
Red Hat Red Hat OpenShift AI

Identifiers

CVE-2026-26007
GHSA-r6ph-v2qm-q3c2
PYSEC-2026-2141

Timeline

2026-02-10: disclosed
2026-02-10: patched: Fixed in version 46.0.5
2026-02-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.