← Vulnerability feed

Vulnerability record · CVE-2026-74870 · published 17 August 2026

CVE-2026-74870: Jahlives openssl encrypt sensitive information in log file vulnerability

JJahlives · Openssl Encrypt

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

8.7 CVSS 4.0 High EPSS 0.26% · top 84.0% CWE-532 · Sensitive information in log file
8.7CVSS 4.0 base score
0.26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
3 Sep 2026Last modified by NVD

Description

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p9g8-wvh4-2jmx Vendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-hardware-pepper-information-disclosure Third Party Advisory

Track CVE-2026-74870 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-81717Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the r…EPSS 0.12%9.3CVE-2026-81719Jahlives openssl encrypt code injection vulnerabilityopenssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an …EPSS 0.44%9.3CVE-2026-81706Jahlives openssl encrypt insufficient verification of data authenticity vulnerabilityopenssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create…EPSS 0.18%9.3CVE-2026-81714Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing t…EPSS 0.20%9.3CVE-2026-81698Jahlives openssl encrypt os command injection vulnerabilityopenssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrust…EPSS 0.43%9.3CVE-2026-81700Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired k…EPSS 0.35%9.3CVE-2026-81701Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directorie…EPSS 0.43%9.3CVE-2026-81702Jahlives openssl encrypt insufficient verification of data authenticity vulnerabilityopenssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitut…EPSS 0.19%

Source: NIST National Vulnerability Database (record CVE-2026-74870), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.