CVE-2026-26007: Cryptography Package Info Disclosure Flaw

CVE-2026-26007 Overview

CVE-2026-26007 is a cryptographic vulnerability in the Python cryptography package that exposes cryptographic primitives and recipes to Python developers. Prior to version 46.0.5, multiple public key loading and generation functions fail to verify that elliptic curve public key points belong to the expected prime-order subgroup of the curve. This missing validation enables small-subgroup attacks that can leak private key information through ECDH key exchange or allow signature forgery in ECDSA operations.

Critical Impact

Attackers can provide malicious public keys from small-order subgroups to extract private key bits during ECDH shared secret computation or forge signatures on SECT binary elliptic curves, compromising cryptographic security guarantees.

Affected Products

• Python cryptography package versions prior to 46.0.5
• Applications using SECT binary elliptic curves (SECT163K1, SECT163R2, SECT233K1, SECT233R1, SECT283K1, SECT283R1, SECT409K1, SECT409R1, SECT571K1, SECT571R1)
• Systems utilizing public_key_from_numbers(), EllipticCurvePublicNumbers.public_key(), load_der_public_key(), or load_pem_public_key() functions

Discovery Timeline

• 2026-02-10 - CVE-2026-26007 published to NVD
• 2026-02-10 - Patch released in version 46.0.5 (credit to XlabAI Team of Tencent Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine)
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-26007

Vulnerability Analysis

This vulnerability stems from insufficient validation in elliptic curve cryptography operations within the cryptography package. The affected functions—public_key_from_numbers(), EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key()—accept public key points without verifying membership in the expected prime-order subgroup.

For elliptic curves with a cofactor greater than 1 (characteristic of binary/SECT curves), the curve's group of points contains small-order subgroups. When an attacker supplies a public key point P from one of these small-order subgroups, cryptographic operations produce predictable results that leak information about the victim's private key.

In ECDH key exchange scenarios, when a victim computes the shared secret S = [victim_private_key]P using the attacker's malicious point, the result reveals victim_private_key mod (small_subgroup_order). This effectively leaks the least significant bits of the private key. For ECDSA signature verification using these weak public keys, attackers can forge signatures that appear valid within the small subgroup context.

Root Cause

The root cause is classified under CWE-345 (Insufficient Verification of Data Authenticity). The public key loading functions do not perform subgroup membership checks, which are essential for curves with cofactors greater than 1. Proper elliptic curve implementations should validate that any received public key point lies in the correct prime-order subgroup before using it in cryptographic computations.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction, though it demands some cryptographic expertise to execute. An attacker must:

1. Identify a target application using the vulnerable cryptography package with SECT binary curves
2. Generate a malicious public key point from a small-order subgroup of the target curve
3. Present this malicious public key to the victim during ECDH key exchange or for ECDSA verification
4. Collect the resulting cryptographic outputs to derive private key bits or forge signatures

The following patch from the security fix shows the SECT curves that are now deprecated due to this vulnerability:

_SECT_CURVES: tuple[type[EllipticCurve], ...] = (
    SECT163K1,
    SECT163R2,
    SECT233K1,
    SECT233R1,
    SECT283K1,
    SECT283R1,
    SECT409K1,
    SECT409R1,
    SECT571K1,
    SECT571R1,
)

for _curve_cls in _SECT_CURVES:
    utils.deprecated(
        _curve_cls,
        __name__,
        f"{_curve_cls.__name__} will be removed in the next release.",
        utils.DeprecatedIn46,
        name=_curve_cls.__name__,
    )

Source: GitHub Commit

Detection Methods for CVE-2026-26007

Indicators of Compromise

• Unusual elliptic curve public key values being submitted to applications, particularly points with small orders
• Repeated ECDH key exchange attempts with varying public keys from the same source
• Failed signature verifications followed by successful ones with modified parameters
• Log entries showing cryptographic operations with SECT curve identifiers

Detection Strategies

• Audit Python dependencies using pip list or package managers to identify cryptography versions below 46.0.5
• Implement software composition analysis (SCA) tools to flag vulnerable library versions in CI/CD pipelines
• Review application code for usage of SECT binary elliptic curves and the affected functions
• Monitor for security advisories from the pyca/cryptography GitHub repository

Monitoring Recommendations

• Enable verbose logging for cryptographic operations to capture public key parameters
• Set up automated dependency scanning to alert on outdated cryptography package versions
• Monitor network traffic for anomalous patterns in TLS handshakes or custom ECDH implementations
• Implement runtime application security monitoring to detect unusual cryptographic function call patterns

How to Mitigate CVE-2026-26007

Immediate Actions Required

• Upgrade the Python cryptography package to version 46.0.5 or later immediately
• Audit all applications for usage of SECT binary elliptic curves and plan migration to recommended curves (e.g., P-256, P-384)
• Review cryptographic implementations for direct use of the affected functions with external public keys
• Rotate any cryptographic keys that may have been used with SECT curves in potentially compromised exchanges

Patch Information

The vulnerability is addressed in cryptography version 46.0.5, released on 2026-02-10. The fix adds proper subgroup membership validation for elliptic curve public keys. Additionally, support for SECT binary elliptic curves has been deprecated and will be removed in the next release. For detailed patch information, see the GitHub Security Advisory and the patch commit.

Workarounds

• If immediate patching is not possible, avoid using SECT binary elliptic curves entirely and migrate to prime-order curves
• Implement application-level validation of public key points before passing them to cryptographic functions
• Restrict network interfaces that accept external public keys until the patch can be applied
• Consider using alternative cryptographic libraries that perform proper subgroup validation

# Upgrade cryptography package to patched version
pip install --upgrade cryptography>=46.0.5

# Verify installed version
pip show cryptography | grep Version

# Check for SECT curve usage in codebase
grep -r "SECT" --include="*.py" /path/to/application/