CVE-2026-21226

Aliases:GHSA-jm66-cg57-jjv5PYSEC-2026-1208CGA-2p4v-cxjj-cprjCGA-48pf-ppr3-qq74CGA-76f8-c3cr-wwmwCGA-c788-6h53-64gxCGA-cg36-mf5c-wvh4CGA-cwhw-w289-4677CGA-fg7c-w7wm-jfr4CGA-fr5v-rm77-7cfjCGA-g9gc-gg23-3v2cCGA-h57x-3prw-rvc6CGA-mf3g-xq67-vpfpCGA-2j3c-v8wh-x4hrCGA-3gq8-x5cr-72f5CGA-5v9q-8xhp-fh26CGA-6fxc-5w3m-9pqcCGA-6q47-f6cc-w4pgCGA-6wpg-q4hf-9r97CGA-72gq-q436-q3h9CGA-7qrq-3xq9-q3wcCGA-83f5-jxhv-fmx7CGA-8cvh-47f6-8hx7CGA-94q6-vh8f-r247CGA-cqjq-c3hm-qqfhCGA-g27h-5hp3-mxf3CGA-hpx3-hq3q-2299CGA-hrpw-xrph-xpj9CGA-hwpw-mrmx-6gq4CGA-jr9m-5p3g-6vwfCGA-mqm5-hmg4-4wg9CGA-mv92-4295-x8p3CGA-mw36-g43q-jg8wCGA-p67f-5jxc-6rp7CGA-rhxw-wj6w-qgqhCGA-rxmq-w893-mg2gCGA-v3mw-p7q9-fx9mCGA-v66q-qf2x-q6vxCGA-vx9q-g884-jv49CGA-w7cg-89fh-626fCGA-x2j3-3vhw-588pCGA-xcqf-mrcr-8rj4CGA-xhjv-xh5h-jmx2
Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 13 Jan 2026, 18:04
Last modified:30 Jul 2026, 20:47

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.93% LOW
1% probability -0.77%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Jan 2026, 18:04
Published
Vulnerability first disclosed
30 Jul 2026, 20:47
Last Modified
Vulnerability information updated

Description

Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.93%• Percentile: 59%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•airflow-2

    < 2.11.0-r21

  • chainguard•airflow-3

    < 3.1.5-r4

  • chainguard•authentik

    < 2025.10.3-r5

  • chainguard•authentik-fips

    < 2025.10.3-r2

  • chainguard•awx

    < 24.6.1-r25

  • chainguard•az

    < 2.82.0-r1

  • chainguard•barman-cloudnative-pg

    < 3.17.0-r1

  • chainguard•datadog-agent-7.71-core-integrations

    all

  • chainguard•datadog-agent-7.72-core-integrations

    all

  • chainguard•datadog-agent-7.73-core-integrations

    < 7.73.3-r23

  • chainguard•datadog-agent-7.74-core-integrations

    < 7.74.1-r24

  • chainguard•datadog-agent-fips-7.71-core-integrations

    all

  • chainguard•datadog-agent-fips-7.72-core-integrations

    all

  • chainguard•datadog-agent-fips-7.73-core-integrations

    < 7.73.3-r26

  • chainguard•datadog-agent-fips-7.74-core-integrations

    < 7.74.1-r26

  • chainguard•kserve-storage-controller

    < 0.16.0-r9

  • chainguard•open-webui

    < 0.7.2-r1

  • chainguard•pgadmin4

    < 9.11-r2

  • chainguard•py3-cassandra-medusa

    < 0.27.0-r2

  • chainguard•py3.13-duplicity

    < 3.0.7-r2

  • chainguard•request-1276

    < 0.27.0-r3

  • wolfi•airflow-3

    < 3.1.5-r4

  • wolfi•az

    < 2.82.0-r1

  • wolfi•datadog-agent-7.72-core-integrations

    all

  • wolfi•datadog-agent-7.73-core-integrations

    < 7.73.3-r23

  • wolfi•datadog-agent-7.74-core-integrations

    < 7.74.1-r24

  • wolfi•kserve-storage-controller

    < 0.16.0-r9

  • wolfi•open-webui

    < 0.7.2-r1

  • wolfi•py3-cassandra-medusa

    < 0.27.0-r2

  • microsoft•azure_core_shared_client_library

    ≥ 1.1.0, < 1.38.0

  • microsoft•azure core shared client library for python

    ≥ 1.1.0, < 1.38.0

  • microsoft•azure_sdk_for_python

    ≥ 1.1.0, ≤ 1.38.0

  • PyPI•azure-core

    < 1.38.0

References (6)