CVE-2026-74875

CVE-2026-74875 is a fail-open validation bypass with two independent attack surfaces: schema validation silently skips when jsonschema is absent, and unrecognized metadata format versions default to permissive acceptance. Both failures create the same outcome — untrusted input passes validation — which means you cannot rely on either layer alone for security. If your environment has jsonschema installed, verify whether version 1.4.0 addresses only the dependency path or also hardens the unknown-version branch. The CVE rating assumes the dependency bypass is the primary risk, but evidence from similar vulnerability lineages suggests the unknown-version fallback may be the more dangerous path: it requires no supply chain manipulation, only a version number the attacker controls. Check your current version-handling code for permissive fallbacks on unrecognized metadata formats — if 'unknown' maps to 'accept' anywhere in your validation logic, that's an independent vulnerability that persists regardless of dependency hygiene. Prioritize these actions: (1) confirm whether 1.4.0 makes jsonschema a hard dependency or adds inline validation — the former leaves minimal deployments exposed if the dependency is manually stripped; (2) audit the unknown-version code path for what it feeds into downstream (key derivation, serialization, cross-service payloads) — that's where the actual impact materializes; (3) treat any metadata parser that defaults to permissive on unrecognized versions as actively exploitable until proven otherwise. The CVSS 9.8 may overstate internet-facing exploitability but understates the structural risk in deployments where both bypasses coexist as redundant failures.

Reviewed through automated stages and approved by a human before publication.