Fix two reachable cryptography CVEs: needs an agt-core 4.1.1 with the cap lift backported

[imran-siddique]

Corrected

My first pass on this issue said agt-core 5.0.0's agentrust-trace<0.3.0 pin looked like a packaging oversight and that lifting it would unblock us. That was wrong on both counts, and the real picture is better in one way and worse in another.

What is actually true

cryptography 48.0.1 carries three advisories. Two are reachable here, through the untrusted cert_chain a claim carries into verify_ak_ek_chain and verify_vcek_chain:

advisory	what it is	fixed in	reachable
CVE-2026-69249	duplicate self-signed intermediates cause exponential path building	49.0.0	yes
CVE-2026-69248	X.509 verifier accepts wildcard DNS names, escaping permittedSubtrees	49.0.0	yes
CVE-2026-69247	Bleichenbacher oracle in PKCS#7 EnvelopedData decryption	50.0.0	no, we only parse cert bundles

49.0.0 is enough, and I verified it end to end in a clean venv with agt-core 4.1.0 and cryptography forced to 49.0.0:

cmcp test suite            1041 passed, 22 skipped
CedarBackend evaluate()    works, policy decisions unchanged
pip-audit (as CI runs it)  No known vulnerabilities found, 1 ignored   -> exit 0

So the cap is not load-bearing for anything this package exercises. Take 49.0.0 and CI goes green with the single unreachable advisory already suppressed.

The one thing blocking it

agent-governance-toolkit-core 4.1.0, which is the release pip resolves for us, pins cryptography>=46.0.7,<49.0.

The cap was already lifted upstream, in #3070 (e75972f7, 2026-06-17, a one-line change to <50.0). It missed the 4.x line by 8 days: v4.1.0 was tagged 2026-06-09, and the monorepo moved to 5.0.0 on 2026-06-25. So the fix exists in history and has never shipped in a release we can install.

Why we cannot just take agt-core 5.x

This is the part my first pass got backwards. The agentrust-trace<0.3.0 cap on 5.0.0 was not an oversight: it was added deliberately in #3240, "cap agentrust-trace below 0.3.0 to restore TRACE validation", and it was lifted on main in #3454 to >=0.5.1,<0.6.0. So a release cut from main today would resolve cleanly against our agentrust-trace>=0.5.

But the same line of work deleted the API we depend on. #3444 replaced the v4 policy language with ACS v5 and removed agent_os/policies/backends.py. CedarBackend does not exist on main. PolicyEvaluator in policy/evaluator.py imports it directly:

from agent_os.policies.backends import CedarBackend

So the release that fixes our pin is the same release that breaks our policy evaluation. Asking for a 5.x release is asking to trade a dependency advisory for a broken gateway.

The ask

Backport e75972f7 to the 4.x line and release agt-core 4.1.1 with cryptography>=46.0.7,<50.0. One line, already written and merged on the other line, with the consumer-side evidence above. There is no 4.x maintenance branch today, so it needs a branch from v4.1.0 plus that cherry-pick.

Filed upstream as microsoft/agent-governance-toolkit#3614.

Done when

• agt-core 4.1.1 published with the lifted cap
• cmcp takes cryptography>=49.0
• the --ignore-vuln CVE-2026-69247 comment in .github/workflows/ci.yml is updated to note the other two are fixed

Separately tracked: the ACS v5 migration this exposed, since staying on agt-core 4.x is not a long-term position.

Worth noting

None of this was visible until #470 fixed pip-audit in CI. It ran with no arguments, hit the editable install of cmcp-runtime first, failed with "Dependency not found on PyPI and could not be audited", and exited before reaching any dependency finding. A security product was carrying a vulnerable pin behind an audit that had never run.

[imran-siddique]

Interim measure landed in #470

The two reachable advisories are now fixed in CI rather than suppressed. The test job installs cryptography>=49,<50 over agt-core 4.1.0's stale <49.0 cap, so pip-audit passes because the vulnerability is gone, not because the report is muted. Only CVE-2026-69247 stays suppressed, and it is genuinely unreachable. If that install step is ever removed before 4.1.1 ships, the audit goes red again, which is the behaviour we want.

This does not close the issue, and it deliberately does not. It fixes what CI tests, not what users get: until agt-core 4.1.1 is on PyPI, pip install cmcp still resolves cryptography 48.x for everyone else, with both reachable advisories live. The gap between our green tick and a user's install is exactly the thing worth not losing track of.

The "Done when" list is unchanged. Add one item to it:

• delete the "Force cryptography past agt-core's stale cap" step in .github/workflows/ci.yml once cryptography>=49.0 is taken in pyproject.toml

Upstream request microsoft/agent-governance-toolkit#3614 is still open.