Repository navigation
standard pip version is below 26.2.2 #1380
Description
Description:
The standard version of pip is not >= 26.2.2, which is a security breach, see certificate compromising
Upon setup
jobs:
check:
runs-on: [self-hosted, linux]
steps:
- name: Set up Python.
uses: actions/setup-python@v7
with:
python-version: '3.12'
pip is < 26.2.2.
Attempting uninstall: pip
Found existing installation: pip 25.0.1
Uninstalling pip-25.0.1:
Successfully uninstalled pip-25.0.1
Successfully installed pip-26.2.2
I am not sure, but I think that pip 26.2.2 is not installed securely by python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
This can result in man-in-the-middle-attacks.
I am not sure how to deal with safe installations of older pip versions.
Action version:
v7
Platform:
- Ubuntu
- macOS
- Windows
Runner type:
- Hosted
- Self-hosted
Tools version:
Python >= 3.11
Repro steps:
See description.
Expected behavior:
Install pip >= 26.2.2 is installed securely.
Actual behavior:
See description.
Activity
v-mahabaleshwars commentedon Oct 26, 2026
Hi @sun-seli,
Thank you for creating this issue. We will investigate it and provide feedback as soon as we have some updates.
johnmreynolds commentedon Oct 26, 2026
Came here to raise the same issue.
Currently the code in find-python.ts does
so if running a vulnerable version of pip will use that for the upgrade.
steve-mavens commentedon Oct 26, 2026
To handle this kind of emergency in future, I think it would be nice to be able to specify the full URL of the pip to install (so in this case it'd be
https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70). Then users could secure setup-python without needing a test runner that already has the fixed pip (or package cache -- wherever 25.0.1 is coming from).johnmreynolds commentedon Oct 26, 2026
Arguably this is also a bug in https://github.com/actions/python-versions, but sadly that repo doesn't have an issues board, and submitting bugs is a real pain.
johnmreynolds commentedon Oct 26, 2026
Though I note python-versions has just released distributions for the bugfix versions of python e.g. 3.14.10 which block the bad certs at the python level. So this is another option (though obviously a version change).
leofang commentedon Nov 1, 2026
Even with this approach, older (but non-EOL'd) Pythons are still impacted, see #1383.
hashlash commentedon Nov 3, 2026
I'm not that familiar with neither python nor pip internals, but based on this announcement, you should probably be fine when you already use the newest security update (3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18) that block the compromised CA.
hashlash commentedon Nov 3, 2026
Additional context for the built-in pip version: it came from
ensurepip(see also). It's the mechanism inside python to install the bundled pip without needing to download it from the internet. The file can be found underLib/ensurepip/_bundled, which for python 3.12 is still pip 25.0.1.It seems that the python maintainer decided to not update pip version on python versions that already entered the security phase, even though the pip update is a security update (python 3.13 was an exception). See:
hashlash commentedon Nov 3, 2026
The issue mentioned on #1383 should only affect windows versions, which means the security patch should be available on all linux versions (see the 3.12.16 release for example).
Seeing the supported windows versions on actions/python-versions are all the ones that still comes with binary release, it might be related to that. Not sure why, but i believe they should be able to build from source instead of just download the binaries (isn't that the point of the repo?), just like what they've done for linux versions.
Details on how python maintainer decide which versions will get the binary release (emphasis are mine):
v-gowridurgad commentedon Nov 6, 2026
Hi @sun-seli, thanks for reporting this and for the additional context. The bundled pip may remain older, but Python 3.12.16 blocks the compromised eMudhra keys in its ssl module. As confirmed in the CPython announcement, this protects normal pip downloads, including upgrading pip itself, even before pip is updated.
For your self-hosted Linux runner, please select python-version: '3.12.16', or use '3.12' with check-latest: true to pick up the latest available patch rather than an older cached installation.