openSUSE Patches Nine PyJWT Token Library Flaws on Tumbleweed GA Media
openSUSE has published advisory openSUSE-SU-2026:11994-1, a moderate-rated update that resolves nine vulnerabilities in the PyJWT library shipped on openSUSE Tumbleweed GA media. The fixed packages are python313-PyJWT 2.15.1-1.1 and python314-PyJWT 2.15.1-1.1. PyJWT implements JSON Web Tokens, the signed credentials behind session handling and service-to-service authentication in many Python applications. The nine issues are tracked as CVE-2026-101917, CVE-2026-101918, CVE-2026-102266, CVE-2026-102268, CVE-2026-102269, CVE-2026-102270, CVE-2026-102272, CVE-2026-102275 and CVE-2026-103001. openSUSE Tumbleweed is the only product named as affected.
The advisory does not publish exploitation details for any of the nine flaws, and no proof-of-concept code or attack chain is described. What SUSE did publish are the severity ratings: CVE-2026-102266, CVE-2026-102268 and CVE-2026-102272 are the highest under CVSS v3.1 at 7.4 each, CVE-2026-102275 and CVE-2026-103001 at 6.5, CVE-2026-101917 and CVE-2026-101918 at 5.3, and CVE-2026-102269 and CVE-2026-102270 at 4.8 and 4.4. SUSE additionally rates CVE-2026-103001 at 8.3 under CVSS v4.0, the highest figure in the set. With no mechanism described, the installed package version is the only reliable indicator of exposure.
Token-handling libraries sit directly on the authentication path, so defects in them carry weight beyond their numeric scores. Tumbleweed is a rolling release, so the affected builds reached general circulation on GA media rather than staying in a test branch. Current exploitation evidence is low: FIRST EPSS gives CVE-2026-101917 and CVE-2026-101918 a 0.4% probability of exploitation within 30 days, CVE-2026-102275 0.1%, and the remaining six 0.2%. No in-the-wild activity is reported and fixed packages are already available, placing this in scheduled maintenance rather than overnight response.
Attack Surface
Web Application, Supply Chain (Third-party vendors), Server OS
Tactics
Initial Access, Credential Access, Impact
Techniques
- T1195.001 – Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1606 – Forge Web Credentials
- T1499 – Endpoint Denial of Service
SuperPRO's Threat Countermeasures Procedures
- Install the update released as openSUSE-SU-2026:11994-1, which delivers python313-PyJWT 2.15.1-1.1 on openSUSE Tumbleweed GA media and fixes all nine listed CVEs.
- Apply the same errata for python314-PyJWT 2.15.1-1.1, which the advisory's package list names alongside the Python 3.13 build, so both interpreter versions are covered.
- Verify after the update that python313-PyJWT and python314-PyJWT both report version 2.15.1-1.1, as that build is the one the advisory identifies as fixed.
- Limit the rollout scope to openSUSE Tumbleweed, the only affected product named in openSUSE-SU-2026:11994-1, so other SUSE and openSUSE releases are not needlessly scheduled for this errata.
- Sequence maintenance windows so hosts exposed to the 7.4-rated CVE-2026-102266, CVE-2026-102268 and CVE-2026-102272, and to CVE-2026-103001 which SUSE rates 8.3 under CVSS v4.0, are patched ahead of the lower-rated 4.4 and 4.8 issues.
- Review the per-CVE pages referenced in the advisory, such as https://www.suse.com/security/cve/CVE-2026-103001.html and https://www.suse.com/security/cve/CVE-2026-102266.html, for updated impact and scope detail before closing the patch ticket.
