Skip to main content

openssl_encrypt EUVDEUVD-2026-60092

| CVE-2026-74873 HIGH
Invocation of Process Using Visible Sensitive Information (CWE-214)
2026-08-17 VulnCheck GHSA-jxvv-jp94-p77v
Information Disclosure Openssl Encrypt
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

Exploitation requires local shell access and reading process args via /proc or ps; PR:L for any local account; confidentiality-only impact with no integrity or availability consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 17, 2026 - 13:18 vuln.today
Analysis Generated
Aug 17, 2026 - 13:18 vuln.today
Patch available
Aug 17, 2026 - 12:01 EUVD
CVE Published
Aug 17, 2026 - 11:04 cve.org
HIGH 8.7

DescriptionCVE.org

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

AnalysisAI

Password exposure in openssl_encrypt before version 1.4.0 allows any local system user to capture plaintext encryption and keystore passwords by reading process argument listings. When operators pass credentials via the --password or -p CLI flags, those values appear verbatim in /proc/[pid]/cmdline and ps aux output on Linux/Unix multi-user systems. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain local shell access
Delivery
Monitor /proc or ps aux for openssl_encrypt processes
Exploit
Observe --password argument in process listing
Execution
Capture plaintext credential from argv
Impact
Use credential to decrypt protected data or access keystore
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a local user account on the same multi-user system where openssl_encrypt is being invoked with the --password or -p CLI arguments. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The assigned CVSS 4.0 score of 8.7 with AV:N/PR:N is inconsistent with the actual exploitation model described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged local user on a shared Linux system repeatedly polls ps aux or scans /proc entries with a simple shell loop while another user runs an automated backup or encryption script that invokes openssl_encrypt with --password. Within the brief window of process execution, the attacker captures the plaintext password verbatim from the argument list. …
Remediation Upgrade openssl_encrypt to version 1.4.0 via pip install --upgrade openssl-encrypt. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Immediately identify all systems running openssl_encrypt versions before 1.4.0 and audit recent process logs for unauthorized credential access attempts. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openssl Encrypt

View all
CVE-2026-74872 CRITICAL
9.3 Aug 17

Arbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
CVE-2026-74899 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
CVE-2026-74887 CRITICAL
9.3 Aug 17

Insecure PRNG import in the jahlives openssl_encrypt Python package (all versions before 1.4.0) places Python's non-cryp
CVE-2026-74901 CRITICAL
9.3 Aug 17

Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with c
CVE-2026-74900 CRITICAL
9.3 Aug 17

Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
CVE-2026-74896 CRITICAL
9.3 Aug 17

Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
CVE-2026-74895 CRITICAL
9.3 Aug 17

Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
CVE-2026-74894 CRITICAL
9.3 Aug 17

Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
CVE-2026-74890 CRITICAL
9.3 Aug 17

Integrity-protection bypass in the jahlives openssl_encrypt Python library (all versions before 1.4.0) lets an attacker

CVE-2026-74889 CRITICAL
9.3 Aug 17

Weak cryptographic key derivation in the openssl_encrypt Python library (all versions before 1.4.0) stems from its key-n
CVE-2026-74886 CRITICAL
9.3 Aug 17

Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
CVE-2026-74885 CRITICAL
9.3 Aug 17

Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before

Same weakness CWE-214 – Invocation of Process Using Visible Sensitive Information

View all
CVE-2024-4254 HIGH POC
7.1
CVE-2026-12250 HIGH
7.9
CVE-2018-17957 HIGH
7.8
CVE-2018-16837 HIGH
7.8
CVE-2024-28799 HIGH
7.5
CVE-2019-3869 HIGH
7.2
CVE-2020-5422 MEDIUM
6.5
CVE-2025-1333 MEDIUM
6.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-60092 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy