Read the docs
TI-2026-52611 Aliases CVE-2026-74892GHSA-qg6r-j76g-wv2q

openssl_encrypt before 1.4.0 Hardcoded Secret Key

Priority MEDIUM 44CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00509 43rd percentileScored 2026-11-07
Fix Fixed openssl_encrypt (jahlives): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jahlivesopenssl_encryptbefore 1.4.01.4.0Patch availableCNA
  • openssl_encrypt Vendorjahlives Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:*before 1.4.0Vulnerablejahlives
  • cpe:2.3:a:jahlives:openssl_encrypt:*:*:*:*:*:python:*:* Versions before 1.4.0 Vulnerable ·jahlives

Remediation

  • Fix · CNA openssl_encrypt (jahlives) Fixed in 1.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    jahlives openssl_encrypt 1.4.0

    28 records Highest priority Priority HIGH 3 HIGH, 21 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-52616 openssl_encrypt before 1.4.0 Sandbox Escape via Type HierarchyPriority HIGH 81
    • TI-2026-52615 openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute TraversalPriority HIGH 81
    • TI-2026-52602 openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and ioPriority HIGH 79
    Show all 28 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-74892
  2. 2026-10-03 Alias added: GHSA-qg6r-j76g-wv2q

References

Advisory 1

  • TI-2026-52616 openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy CVSS 4.0CRITICAL 9.3
  • TI-2026-52615 openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal CVSS 4.0CRITICAL 9.3
  • TI-2026-52602 openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io CVSS 4.0HIGH 8.7
  • TI-2026-52617 openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode CVSS 4.0CRITICAL 9.3
  • TI-2026-52614 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation CVSS 4.0CRITICAL 9.3
  • TI-2026-52613 openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token CVSS 4.0CRITICAL 9.3
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences