fix(deps): bump pyOpenSSL to 26.3.0 and msal to 1.37.0 for CVE-2026-34180

[Jan-Kazlouski-elastic]

Part of https://github.com/elastic/security/issues/12757 (CVE-2026-34180)

Description

Proactive dependency bump to remediate CVE-2026-34180, a heap buffer over-read in OpenSSL's ASN.1 decoder (d2i_* functions) when parsing a crafted DER structure with a primitive element exceeding 2 GB on 64-bit Unix-like platforms (CWE-125, CVSS 7.5 HIGH — DoS / out-of-bounds memory read). Fixed in OpenSSL 4.0.1 / 3.6.3 / 3.5.7 / 3.4.6 / 3.0.21.

In this codebase the vulnerable OpenSSL is statically bundled inside the cryptography wheel (a transitive dependency). The resolved cryptography 46.0.7 wheel ships OpenSSL 3.5.6, which is affected (3.5.0 <= x < 3.5.7).

cryptography was capped below the fix by two parents:

• pyOpenSSL==26.0.0 → cryptography<47
• msal==1.32.3 → cryptography<47

This PR bumps both parents so the resolver can pull a fixed cryptography:

• pyOpenSSL 26.0.0 → 26.3.0 (requires cryptography>=49.0.0)
• msal 1.32.3 → 1.37.0 (allows cryptography<51)

Result: cryptography resolves to 49.0.0, whose wheels ship OpenSSL 4.0.1 (fixed). NOTICE.txt regenerated accordingly.

Bundled OpenSSL confirmed via cryptography's backend: before 3.5.6 → after 4.0.1.

Affected assessment

Not Affected. The vulnerable d2i_* decoders are present, but exploitation requires an attacker to feed a crafted DER ASN.1 structure with a >2 GB primitive element into the decoder. Connectors only initiates outbound connections to operator-configured third-party data sources; it is not a public-facing service accepting arbitrary attacker-controlled certificates/DER blobs, so the input to the affected code path cannot be attacker-controlled. Bumped proactively regardless.

Scanner A/B (CVE-2026-34180)

Tool	Before	After
pip-audit	n/a	n/a
Trivy	n/a	n/a
Snyk	reported	clear

Snyk (which tracks the OpenSSL bundled in the cryptography wheel) reported the CVE on the pre-fix set and cleared it after the bump. pip-audit and Trivy do not map this OpenSSL CVE to the PyPI package, so they were inconclusive (not a fail).

Checklists

Pre-Review Checklist

• this PR does NOT contain credentials of any kind
• this PR has a meaningful title
• this PR has a thorough description
• Tested the changes locally (make clean install autoformat lint test — 2293 tests passed, 92.18% coverage)
• Added a label for each target release version

Changes Requiring Extra Attention

• Security-related changes (bundled OpenSSL via cryptography)

Release Note

Bump pyOpenSSL to 26.3.0 and msal to 1.37.0 to pull cryptography 49.0.0 (bundled OpenSSL 4.0.1), remediating CVE-2026-34180.

Made with Cursor

[github-actions]

💔 Failed to create backport PR(s)

Status	Branch	Result
✅	9.5	#4271
✅	9.4	#4272
❌	8.19	Commit could not be cherrypicked due to conflicts

Successful backport PRs will be merged automatically after passing CI.

To backport manually run:
backport --pr 4270 --autoMerge --autoMergeMethod squash

[github-actions]

💚 Backport PR(s) successfully created

Status	Branch	Result
✅	9.3	#4285

This backport PR will be merged automatically after passing CI.