CVE-2026-32597 - Upgrade pyJWT #32969

Activity

1. Pranav (blueelvis)

   added

   bugThis issue requires a change to an existing behavior in the product in order to be resolved.This issue requires a change to an existing behavior in the product in order to be resolved.

   on Mar 14, 2026
2. yonzhan commented on Mar 14, 2026

   

   Yong Zhang (yonzhan)

   on Mar 14, 2026

   Collaborator

   More actions

   Thank you for opening this issue, we will look into it.
3. microsoft-github-policy-service

   added

   customer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.

   on Mar 14, 2026
4. github-actions commented on Mar 14, 2026

   

   github-actionsbot

   on Mar 14, 2026 – with GitHub Actions

   More actions

   This issue is related to security. Please pay attention.

   Powered by issue-sentinel

   😕React with 😕1Reacted by Arjen de Blok
5. github-actions

   added

   Security-Issue

   on Mar 14, 2026
6. Yong Zhang (yonzhan)

   assigned

   Hang (bebound)

   and

   Naga Nandyala (naga-nandyala)

   on Mar 15, 2026
7. Yong Zhang (yonzhan)

   added

   Azure CLI TeamThe command of the issue is owned by Azure CLI teamThe command of the issue is owned by Azure CLI team

   feature-request

   and removed

   bugThis issue requires a change to an existing behavior in the product in order to be resolved.This issue requires a change to an existing behavior in the product in order to be resolved.

   on Mar 15, 2026
8. Yong Zhang (yonzhan)

   added this to the Backlog milestone on Mar 15, 2026
9. ajblokpor commented on Jun 26, 2026

   

   Arjen de Blok (ajblokpor)

   on Jun 26, 2026

   Last edited by ajblokpor

   More actions

   When will this BUG be solved? Our security department does not allow to have CVE issues that is marked as a high vulnerability.
   So we cannot use the Azure-CLI anymore which is quite annoying because our CI/CD depends on it.
10. faust64 commented on Oct 4, 2026

    

    Samuel (faust64)

    on Oct 4, 2026

    More actions

    that one looks fixed?
    Today, azure-cli-2.90.0-1.el10.x86_64's pyJWT is affected by CVE-2026-102268
    Comes with pyJWT 2.13.0. Issue fixed in 2.14.0

    Simlar to Arjen de Blok: this is very problematic running azure CLI in company like ours. CRITICAL + fixable must be fixed within a few days, or I need to get it out.
11. Yong Zhang (yonzhan)

    assigned

    mansoor sarfraz (msarfraz)

    and unassigned

    Hang (bebound)

    on Oct 5, 2026
12. msarfraz commented on Oct 8, 2026

    

    mansoor sarfraz (msarfraz)

    on Oct 8, 2026

    Last edited by msarfraz

    Contributor

    More actions

    pyJWT is upgraded to 2.15.0 and will be available in the next release. November 2026 (2026-11-03)

    👍React with 👍1Reacted by Yong Zhang
13. mansoor sarfraz (msarfraz)

    closed this as completedon Oct 8, 2026