Update version of python packaged with Azure CLI #34221
Description
Describe the bug
The current version of Python that's packaged with Azure CLI (3.14.7.x) is flagged as a vulnerability. Running az upgrade go only up to the exact version 3.14.7150.1013. Please update this.
Related command
az upgrade
Errors
Causing vulnerability scanners to pick it up constantly.
Issue script & Debug output
The current version of Python that's packaged with Azure CLI (3.14.7.x) is flagged as a vulnerability. Running az upgrade go only up to the exact version 3.14.7150.1013. Please update this.
Expected behavior
Should be using a newer version of python.
Environment Summary
azure-cli 2.91.0
core 2.91.0
telemetry 1.1.0
Extensions:
stack-hci-vm 1.16.0
Dependencies:
msal 1.39.0
azure-mgmt-resource 24.0.0
Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\adam.gindt.azure'
Extensions directory 'C:\Users\adam.gindt.azure\cliextensions'
Python (Windows) 3.14.7 (tags/v3.14.7:823f032, Aug 5 2026, 10:51:32) [MSC v.1944 64 bit (AMD64)]
Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.
Additional context
No response
Activity
yonzhan commentedon Oct 13, 2026
Thank you for opening this issue, we will look into it.
x-engineering-agent commentedon Oct 13, 2026
Hi Adam G (@AdamG9923), the report identifies Azure CLI 2.91.0 on Windows and its bundled Python 3.14.7, with
az upgradereporting that the CLI is up to date.Could you share the scanner finding's CVE/advisory ID and its affected/fixed version range? That is needed to distinguish a bundled-runtime vulnerability from a package-version detection issue and identify the required update. Please omit credentials and other sensitive scan details.
The issue will be picked up automatically once you reply.
Posted by x-engineering-agent (Fixer)
microsoft-github-policy-service commentedon Oct 13, 2026
🔔 Routing this issue to @Azure/act-platform-engineering-squad.
AdamG9923 commentedon Oct 13, 2026
This is being flagged by Microsoft Defender
CVE-2026-19445
AdamG9923 commentedon Oct 13, 2026
x-engineering-agent commentedon Oct 13, 2026
Analysis
The reported CLI 2.91.0 installation bundles Python 3.14.7. The PSF advisory lists Python 3.14.0 through versions below 3.14.8 as affected. It describes a server-side
SSLContextlifetime defect when an SNI callback switches contexts and explicitly says TLS clients are not affected. An affected bundled version is not, by itself, evidence of an exploitable Azure CLI code path.The source fix already exists in commit abd03e8. The Windows build script pins Python 3.14.8 for MSI and ZIP packaging; the 2.91.0 source pins 3.14.7. A separate Python installation does not replace the bundled interpreter.
az upgradechecks the available CLI version, so “up-to-date” does not establish that every bundled dependency is current.Packaging-maintainer follow-up: confirm which published Windows MSI/ZIP artifacts contain Python 3.14.8 or a newer fixed version, decide whether a backport/refreshed release is needed, and provide the supported upgrade path. Confirm the interpreter version in the distributed artifacts and installed CLI, then reassess the Defender finding. Source changes alone do not establish that published installers or existing installations are fixed; no release date or artifact remediation is confirmed here.
The CVE and environment details are sufficient for this handoff. No additional reporter question or duplicate version-bump job is needed. Recommended priority: P2, pending release/artifact confirmation and evidence of an affected server-side usage path.
Posted by x-engineering-agent (Fixer)