From 6841b784ea5814561da59915966f13f2393ddf35 Mon Sep 17 00:00:00 2001 From: Rodrigo Horie Date: Mon, 19 Oct 2026 15:09:46 -0300 Subject: [PATCH] Bump PyJWT to address CVE-2026-102268 Pin PyJWT>=2.14.0 in requirements.in to address CVE-2026-102268 (authentication bypass via improper public key validation). Regenerated requirements.txt via make docker_update_requirements. Assisted-By: Claude Code Signed-off-by: Rodrigo Horie --- requirements/requirements.in | 1 + requirements/requirements.txt | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/requirements/requirements.in b/requirements/requirements.in index 3cb7e3dc12..e8a5276269 100644 --- a/requirements/requirements.in +++ b/requirements/requirements.in @@ -49,6 +49,7 @@ psutil pyasn1>=0.6.2 # CVE-2026-2349 pygerduty PyGithub +PyJWT>=2.14.0 # CVE-2026-102268 pyopenssl pyparsing>3.0 # Upgraded to v3 and changed import patterns python-daemon diff --git a/requirements/requirements.txt b/requirements/requirements.txt index c88ffb6a0a..777987f938 100644 --- a/requirements/requirements.txt +++ b/requirements/requirements.txt @@ -384,8 +384,9 @@ pygithub==2.8.1 # via # -r /awx_devel/requirements/requirements.in # awx-plugins-core -pyjwt[crypto]==2.10.1 +pyjwt[crypto]==2.15.1 # via + # -r /awx_devel/requirements/requirements.in # adal # django-ansible-base # msal