Detections
Analytics

Chainguard: py3.12-airflow-3: security update to 3.3.2-r11

critical Tenable Cloud Security Plugin ID 477758

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0,
 OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept
 leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm
 registry and already configure verification with PEM or certificate bytes containing such a prefix, an
 unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge
 HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for
 CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in
 authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key
 material. This issue is fixed in version 1.9.0. (CVE-2026-114615)

Solution

Update the py3.12-airflow-3 library and its related packages to version 3.3.2-r11 or later.

Plugin Details

Severity: Critical

ID: 477758

Version: Revision 1.2

Type: Local

Published: 10/29/2026

Updated: 11/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.54

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-114615

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/22/2026

Reference Information

CVE: CVE-2026-114615