CVE Intelligence
Analysis AI-assisted

CVE-2026-74876: Jahlives openssl_encrypt Unverified Key Bundle Signature Flaw

Versions of Jahlives openssl_encrypt before 1.4.0 build key bundles from untrusted data in PublicKeyBundle.from_dict() without verifying signatures, classified as CWE-347. The record links this to possible exposure of secrets, and the CVSS 3.1 base score is 9.8 (Critical). No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a flaw in openssl_encrypt versions before 1.4.0 in PublicKeyBundle.from_dict(), which creates key bundles from untrusted data without verifying signatures (CWE-347). The issue is tracked as CVE-2026-74876 and was published on 2026-08-17.

Impact

  • According to the record, data can be encrypted to attacker-controlled public keys, which can lead to leakage of secrets.
  • The CVSS 3.1 base score is 9.8 (Critical), with high confidentiality, integrity and availability impact in the vector.
  • The record also lists a CVSS 4.0 score of 9.3.

Affected products and versions

  • Jahlives Openssl Encrypt, versions less than 1.4.0. The record does not list exact fixed builds beyond the vendor advisory reference.

Exploitation status

  • The CISA KEV field in the record is not listed. No confirmed exploitation appears in the sources consulted.
  • SSVC exploitation is recorded as none and automatable as yes. EPSS probability is 0.00348 with percentile 0.26527.

Remediation and mitigation

  • Identify deployments of openssl_encrypt below 1.4.0 and plan an update to 1.4.0 or later, following the vendor advisory.
  • Until updated, avoid importing key bundles from untrusted sources and do not trust outputs of from_dict() without independent verification of key ownership.
  • Treat secrets encrypted to keys taken from untrusted bundles as potentially exposed, and rotate sensitive material where appropriate.

Detection guidance

  • Review software inventories and dependency manifests for openssl_encrypt installations and their versions.
  • Audit application workflows for key bundle imports originating from external or untrusted sources.

Limitations of the available information

  • The record gives only a short technical description and does not state an exact fixed version string.
  • The record classifies the fix reference as mitigation; the vendor advisory should be consulted to confirm whether a patched release is available.
  • The EPSS date in the record is later than the publication date; values are reported as recorded.

Frequently asked questions

Which versions are affected by CVE-2026-74876?

The record lists Jahlives Openssl Encrypt versions less than 1.4.0 as affected. It does not list exact fixed builds beyond the vendor advisory.

Is this vulnerability known to be exploited in the wild?

The CISA KEV field in the record is not listed, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.