GitHub Actions · Python · Security · Checked November 5, 2026

CVE-2026-115557 in Python's ssl module and GitHub Actions: the fixed versions, and why setup-python cannot install 3.11.18, 3.12.16 or 3.13.18 on Windows and macOS

CVE-2026-115557 (the record, published by the Python Software Foundation on October 24, 2026) is Python's answer to the compromised eMudhra intermediate CAs: the ssl module now has a list of them and rejects them whatever the SSLContext is set to. The fixed versions are 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2; everything older on each line is affected. Image and dependency scanners report it against the Python they find (one report reads "CVE-2026-115557 in python@3.12.14"). On GitHub Actions the catch is that actions/setup-python does not have the three older fixes for Windows and macOS.

What setup-python has (November 5, 2026)

From the manifest that setup-python reads (actions/python-versions):

• 3.14.10 and 3.15.2: Ubuntu 22.04, 24.04 and 26.04, RHEL 9 and 10, macOS and Windows.
• 3.11.18, 3.12.16 and 3.13.18: Ubuntu and RHEL only. No macOS and no Windows files. The last 3.13 with Windows and macOS files is 3.13.17, which is affected.

On Windows, setup-python's packages are the installers from python.org, and python.org has none for these three releases (setup-python #1383; GitHub says nothing will change on the setup-python side).

What a workflow gets

• python-version: '3.13.18' on windows-latest or macos-latest fails: The version '3.13.18' with architecture 'x64' was not found for ..., followed by the link to the manifest.
• python-version: '3.13' (or '3.12', '3.11') does not fail. It takes the newest matching version already on the runner, or with check-latest: true the newest one in the manifest for that system, which is 3.13.17. The job stays green on an affected Python, so a scan or a version check is the only way to notice.
• On Ubuntu, '3.13' with check-latest: true resolves to 3.13.18. Without it, you get the version the image has cached, if it has one, which may still be older.

To see which one a job got, print it right after setup: python -VV. To test the fix itself, connect to one of the disclosure's test hosts; a fixed Python raises ssl.SSLCertVerificationError:

- run: python -c "import urllib.request; urllib.request.urlopen('https://dv-g3b-emudhra.we-have-a-problem.com/')"

This step fails on a fixed Python and passes on an affected one, so run it with continue-on-error: true or reverse the check if you keep it.

Ways out on Windows and macOS

• Move to 3.14.10 or 3.15.2, which setup-python has everywhere.
• Install the fixed 3.11, 3.12 or 3.13 with uv. Its interpreters are the python-build-standalone builds, and the 20261026 release has 3.11.18, 3.12.16 and 3.13.18 for Windows and macOS (python-build-standalone 20261026). With astral-sh/setup-uv, run uv python install 3.13.18 and run the job's commands with uv run; uv python list --all-versions shows whether your uv already knows the new builds.
• Run the jobs that talk to the network, such as publishing or downloading, on Ubuntu, and keep the Windows and macOS jobs for tests that do not depend on TLS.

Once you are on a fixed Python, the check is in the ssl module itself, so it also covers libraries such as requests that load an older certifi bundle. pip has its own copy of the roots; pip 26.2.2 has the fix.

Telling it apart

• Go's fix for the same keys is a different advisory, GO-2026-6809 (govulncheck and GO-2026-6809).
• Apple's /usr/bin/python3 on the macOS runners is not the one setup-python installs; it checks against /etc/ssl/cert.pem (the eMudhra CA compromise on the runners).

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, so a setup step that failed on one system of the matrix stands out, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Python is a trademark of the Python Software Foundation; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by any of them.

More: The eMudhra CA compromise on the runners · govulncheck and GO-2026-6809 · GitHub Actions plugins for IntelliJ IDEA compared · 日本語