Jahlives vulnerabilities

CVE-2026-74885 Low · 3.6 CWE-117 Aug 17, 2026

openssl_encrypt before 1.4.0 Logging Bug and Race Condition

openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments.

CVE-2026-74884 High · 7.5 CWE-73 Aug 17, 2026

openssl_encrypt before 1.4.0 Path Traversal via plugin_id

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.

CVE-2026-74883 High · 8.8 CWE-693 Aug 17, 2026

openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

CVE-2026-74882 Critical · 9.1 CWE-345 Aug 17, 2026

openssl_encrypt before 1.4.0 Insecure Default Configuration

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

CVE-2026-74881 Critical · 9.3 CWE-942 Aug 17, 2026

openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins

openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them.

CVE-2026-74880 Critical · 9.8 CWE-598 Aug 17, 2026

openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

CVE-2026-74879 High · 7.5 CWE-209 Aug 17, 2026

openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

CVE-2026-74878 Critical · 9.8 CWE-770 Aug 17, 2026

openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass

openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.

CVE-2026-74877 High · 8.8 CWE-639 Aug 17, 2026

openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key

openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.

CVE-2026-74876 Critical · 9.8 CWE-347 Aug 17, 2026

openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption

openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets.

CVE-2026-74871 Medium · 5.5 CWE-916 Aug 17, 2026

openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR

openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.

CVE-2026-74870 Low · 3.3 CWE-532 Aug 17, 2026

openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

CVE-2026-74875 Critical · 9.8 CWE-345 Aug 17, 2026

openssl_encrypt before 1.4.0 Schema Validation Bypass

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

CVE-2026-74874 High · 7.5 CWE-338 Aug 17, 2026

openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

CVE-2026-74873 Medium · 5.5 CWE-214 Aug 17, 2026

openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

CVE-2026-74872 Critical · 9.8 CWE-426 Aug 17, 2026

openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.