From 5333d0d1f9930e4d40ae63e38643e674ff740d4b Mon Sep 17 00:00:00 2001 From: Rodrigo Toshiaki Horie Date: Tue, 27 Oct 2026 09:28:31 -0300 Subject: [PATCH] Bump PyJWT to address CVE-2026-102268 (#16748) * Bump PyJWT to address CVE-2026-102268 Pin PyJWT>=2.14.0 in requirements.in to address CVE-2026-102268 (authentication bypass via improper public key validation). Regenerated requirements.txt via make docker_update_requirements. Assisted-By: Claude Code Signed-off-by: Rodrigo Horie * Use a 32+ byte HMAC key in workload identity tests PyJWT >= 2.11 emits InsecureKeyLengthWarning for HS256 keys shorter than 32 bytes, which pytest's filterwarnings=error turns into an exception that populate_workload_identity_tokens swallows, so the Gateway request is never made. Assisted-By: Claude Code Signed-off-by: Rodrigo Horie --------- Signed-off-by: Rodrigo Horie --- awx/main/tests/functional/test_jobs.py | 6 +++--- requirements/requirements.in | 1 + requirements/requirements.txt | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/awx/main/tests/functional/test_jobs.py b/awx/main/tests/functional/test_jobs.py index aa2f996b5a..65117079c1 100644 --- a/awx/main/tests/functional/test_jobs.py +++ b/awx/main/tests/functional/test_jobs.py @@ -468,7 +468,7 @@ def test_run_job_cloud_credentials(job_template_with_credentials): @pytest.mark.django_db -@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False}) +@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False}) def test_populate_workload_identity_tokens_with_flag_enabled(job_template_with_credentials, mocker): """Test populate_workload_identity_tokens sets context when flag is enabled.""" with feature_flag_enabled('FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED'): @@ -529,7 +529,7 @@ def test_populate_workload_identity_tokens_with_flag_enabled(job_template_with_c @pytest.mark.django_db -@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False}) +@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False}) def test_populate_workload_identity_tokens_passes_workload_ttl_from_job_timeout(job_template_with_credentials, mocker): """Test populate_workload_identity_tokens passes workload_ttl_seconds from get_instance_timeout to the client.""" with feature_flag_enabled('FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED'): @@ -628,7 +628,7 @@ def test_populate_workload_identity_tokens_with_flag_disabled(job_template_with_ @pytest.mark.django_db -@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False}) +@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False}) def test_populate_workload_identity_tokens_multiple_input_sources_per_credential(job_template_with_credentials, mocker): """Test that a single credential with two input sources from different workload identity credential types gets a separate JWT token for each input source, keyed by input source PK.""" diff --git a/requirements/requirements.in b/requirements/requirements.in index 3cb7e3dc12..e8a5276269 100644 --- a/requirements/requirements.in +++ b/requirements/requirements.in @@ -49,6 +49,7 @@ psutil pyasn1>=0.6.2 # CVE-2026-2349 pygerduty PyGithub +PyJWT>=2.14.0 # CVE-2026-102268 pyopenssl pyparsing>3.0 # Upgraded to v3 and changed import patterns python-daemon diff --git a/requirements/requirements.txt b/requirements/requirements.txt index c88ffb6a0a..777987f938 100644 --- a/requirements/requirements.txt +++ b/requirements/requirements.txt @@ -384,8 +384,9 @@ pygithub==2.8.1 # via # -r /awx_devel/requirements/requirements.in # awx-plugins-core -pyjwt[crypto]==2.10.1 +pyjwt[crypto]==2.15.1 # via + # -r /awx_devel/requirements/requirements.in # adal # django-ansible-base # msal