CVE-2026-74870

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

• CWE-532

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p9g8-wvh4-2jmxVendor Advisory
• https://www.vulncheck.com/advisories/openssl-encrypt-before-hardware-pepper-information-disclosureThird Party Advisory

Published

Aug 17, 2026

Last Modified

Sep 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-74865sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAut…9.2
• CVE-2026-74866@fastify/busboy is a multipart form-data parser for Node.js.…5.8
• CVE-2026-74867SiYuan versions before 3.7.4 contain a cross-site request fo…4.2
• CVE-2026-74868SiYuan versions before 3.7.4 contain an unthrottled brute-fo…7.5
• CVE-2026-74869stoatchat before 0.15.0 contains a missing authorization vul…7.7
• CVE-2026-7487GitLab has remediated an issue in GitLab EE affecting all ve…3.5
• CVE-2026-74871openssl_encrypt versions before 1.4.6 contain a key derivati…5.5
• CVE-2026-74872openssl_encrypt versions before 1.4.0 contain an arbitrary c…9.8
• CVE-2026-74873openssl_encrypt versions before 1.4.0 expose passwords passe…5.5
• CVE-2026-74874openssl_encrypt versions before 1.4.0 use Python's non-crypt…7.5
• CVE-2026-74875openssl_encrypt versions before 1.4.0 silently skip JSON sch…9.8
• CVE-2026-74876openssl_encrypt versions before 1.4.0 contain a vulnerabilit…9.8