Python: ssl eMudhra CA distrust and tarfile fixes (CVE-2026-115557, CVE-2026-114583) in 3.14.10
Published 29/10/2026 10:54
Timeline
2 events over 6 d 21 h
- 22/10/2026 14:11ConfirmedBSI CERT-Bund (WID)+6 d 21 h
- 29/10/2026 10:54Published on WatchtowerPro CISO
In short
Python 3.14.10 is a security release that distrusts compromised eMudhra CA keys in the ssl module and fixes file tampering in tarfile. BSI CERT-Bund and CERT-FR have published warnings. Update Python 3.14 to 3.14.10.
How bad is it
High, according to BSI CERT-Bund. An attacker could bypass security controls, for example by getting certificates from compromised eMudhra CA keys trusted, or tamper with files through crafted tar archives.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
No CVSS score published yet
A missing score is never read as 0.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Fixed in
- 3.14 branch: 3.14.10
What to do now
- If you run Python 3.14, update to 3.14.10, the release python.org lists as fixing these issues.
- Python's vendor note says normal uses of pip, including upgrading pip itself, are now safe from attacks based on the compromised keys even before pip is updated. This reduces exposure and does not make a system safe, so still update.
- If you run another Python branch, check python.org for a fixed release for that branch.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 12 sources with their dates. And technology matching: which of your systems run Python, at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [mittel] CPython: Mehrere Schwachstellen CERT · [UPDATE] [mittel] CPython: Schwachstelle ermöglicht Manipulation von Dateien CERT · [UPDATE] [mittel] Python: Schwachstelle ermöglicht Manipulation und Offenlegung von Daten CERT