Detections
Analytics

Chainguard: py3.12-airflow-3: security update to 3.3.2-r11

medium Tenable Cloud Security Plugin ID 477753

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0,
 OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw
 request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A
 registered client permitted an ID token response type but not the openid scope can add openid to the
 request, obtain user consent, and receive a signed ID token containing the user's subject and allowed
 profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID
 token response are not affected. In authlib/oidc/core/grants/implicit.py,
 OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered
 request.scope. This issue is fixed in version 1.9.0. (CVE-2026-114619)

Solution

Update the py3.12-airflow-3 library and its related packages to version 3.3.2-r11 or later.

Plugin Details

Severity: Medium

ID: 477753

Version: Revision 1.2

Type: Local

Published: 10/29/2026

Updated: 11/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 8.3

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-114619

CVSS v3

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 4.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/22/2026

Reference Information

CVE: CVE-2026-114619