CVE-2026-26007: 
Python vulnerability analysis and mitigation

CVE-2026-26007 is a subgroup confinement (small-subgroup attack) vulnerability in the Python cryptography package affecting all versions prior to 46.0.5. The flaw exists in the public_key_from_numbers(), EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key() functions, which fail to verify that an elliptic curve public key point belongs to the expected prime-order subgroup. Only SECT (binary) curves with cofactor > 1 are impacted. The vulnerability was discovered by the XlabAI Team of Tencent Xuanwu Lab and the Atuin Automated Vulnerability Discovery Engine, disclosed and patched on February 10, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, oss-security).

The root cause is insufficient validation of elliptic curve public key points (CWE-345: Insufficient Verification of Data Authenticity; CWE-354: Improper Validation of Integrity Check Value). When loading or constructing a public key using the affected functions, the library did not invoke OpenSSL's EC_KEY_check_key() for curves with cofactor > 1, allowing a point from a small-order subgroup to be accepted as valid. In an ECDH scenario, when the victim computes S = [victim_private_key]P using a malicious low-order point P, the result leaks victim_private_key mod (small_subgroup_order), revealing the least significant bits of the private key. In ECDSA contexts, an attacker can forge signatures over the small subgroup. The fix (commit 0eebb9d) adds a cofactor check and calls ec.check_key() for all curves with cofactor > 1, and additionally deprecates all SECT curve classes (GitHub Commit, GitHub Advisory).

Successful exploitation primarily impacts confidentiality: an attacker who can supply a crafted public key to a victim application using SECT curves can recover bits of the victim's private key through repeated ECDH interactions, or forge ECDSA signatures on the small subgroup. There is no direct availability or integrity impact on the vulnerable system itself. Downstream IBM products incorporating the affected cryptography package — including IBM App Connect Enterprise, Cloud Pak for Data, Business Automation Workflow, Guardium Data Security Center, QRadar EDR, and others — are also affected, broadening the potential exposure across enterprise environments (GitHub Advisory, IBM Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.007–0.009%, placing it in the 1st percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to applications using SECT (binary) elliptic curves, which are uncommon in modern deployments, and requires user interaction (the victim must perform a cryptographic operation using the attacker-supplied key) (GitHub Advisory, oss-security).

1. Identify target: Locate an application using the Python cryptography package version ≤ 46.0.4 that accepts externally supplied elliptic curve public keys and uses SECT curves (e.g., SECT163K1, SECT233K1, SECT571K1) for ECDH key agreement or ECDSA signature verification.
2. Construct malicious public key: Generate a point P on the target SECT curve that lies in a small-order subgroup (i.e., a point of order equal to a small factor of the curve's cofactor), rather than the prime-order subgroup. This can be done using standard elliptic curve arithmetic tools.
3. Supply the malicious key: Provide the crafted public key to the victim application via any accepted input channel (e.g., TLS handshake, API endpoint, key import function). The unpatched library will accept the point without subgroup validation.
4. Trigger ECDH computation: Cause the victim application to compute a shared secret using the malicious point: S = [victim_private_key] * P. The result leaks victim_private_key mod (small_subgroup_order).
5. Repeat and reconstruct: By repeating with different small-order points (if multiple small subgroups exist), an attacker can recover additional bits of the private key using the Chinese Remainder Theorem, progressively reconstructing the full private key.
6. Forge signatures (ECDSA path): Alternatively, use the small-subgroup point in ECDSA verification contexts to forge valid signatures over messages, bypassing authentication (GitHub Advisory, GitHub Commit).

• Application Logs: Repeated ECDH or ECDSA operations involving SECT curve public keys from unexpected or external sources; ValueError: Invalid EC key exceptions appearing after upgrading to 46.0.5 (indicating previously accepted malicious keys).
• Network: Unusual or repeated key exchange requests to services using SECT elliptic curves; anomalous patterns of ECDH handshakes from a single source IP.
• File System / Package Inventory: Presence of cryptography package versions ≤ 46.0.4 in Python environments (pip show cryptography); affected IBM product versions listed in IBM security bulletins.
• Behavioral: Applications accepting public keys in DER or PEM format from untrusted sources without additional validation; cryptographic operations on SECT163K1, SECT163R2, SECT233K1, SECT233R1, SECT283K1, SECT283R1, SECT409K1, SECT409R1, SECT571K1, or SECT571R1 curves.

The primary remediation is to upgrade the Python cryptography package to version 46.0.5 or later, which adds subgroup validation for all curves with cofactor > 1 and deprecates SECT curves entirely (GitHub Advisory, oss-security). For IBM products, apply the relevant security iFixes and updates documented in the respective IBM support bulletins (IBM Advisory). Oracle Database versions 21.3–21.21 and 23.4.0–23.26.1 are addressed in the April 2026 Critical Patch Update (Oracle CPU). As a workaround where upgrading is not immediately possible, avoid using SECT (binary) elliptic curves in cryptographic operations and validate that public keys originate from trusted sources before use.

The vulnerability was publicly disclosed via the oss-security mailing list on February 10, 2026, by Oracle's Alan Coopersmith forwarding the PyCA release announcement (oss-security). Security news outlets such as SecurityOnline.info covered the flaw, highlighting the CVSS 8.2 score and private key leakage risk. Community discussion on Bluesky (infosec.skyfleet.blue) and developer blogs (dev.to) noted the narrow scope — limited to rarely-used SECT binary curves — as a significant mitigating factor. Multiple Linux distributions (SUSE, Ubuntu, Debian, openSUSE) and enterprise vendors (IBM, Oracle, Red Hat) issued advisories and updated packages in the weeks following disclosure.