Which versions of openssl_encrypt are affected by EUVD-2026-60110?

openssl_encrypt standalone server versions before 1.4.0 contain hardcoded PostgreSQL database credentials in configuration files, enabling any network-adjacent attacker to directly access backend…. A patch is available.

How to fix or mitigate EUVD-2026-60110?

Within 24 hours, inventory all systems running openssl_encrypt and identify installed versions to determine exposure scope. Within 7 days, deploy openssl_encrypt 1.4.0 or later across all affected instances and rotate all PostgreSQL database credentials to invalidate the hardcoded values. Within 30 days, complete patching on all systems and audit database access logs spanning the vulnerability exposure period to identify any unauthorized database access.

openssl_encrypt EUVD-2026-60110

Q: What is the CVSS score of EUVD-2026-60110?

EUVD-2026-60110 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-74891 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-08-17 VulnCheck

GHSA-c472-7fxr-552c

Authentication Bypass Information Disclosure PostgreSQL Openssl Encrypt Jahlives

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Description specifies same-network access, mapping to AV:A; hardcoded credentials require no privileges; impact is confidentiality-only with no integrity or availability effect described.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 13:07 vuln.today

Patch available

Aug 17, 2026 - 12:01 EUVD

CVE Published

Aug 17, 2026 - 11:04 cve.org

HIGH 8.7

DescriptionCVE.org

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.

Articles & Coverage 1

News 3 New PostgreSQL Vulnerabilities - 1 Critical, 2 High Severity Aug 18, 2026

AnalysisAI

Hardcoded PostgreSQL credentials embedded in openssl_encrypt standalone server configuration files expose backend databases to unauthorized access in all versions before 1.4.0. Network-adjacent attackers who obtain the well-known static credentials - trivially available from the distributed software package or public advisory - can authenticate directly to the PostgreSQL instance and retrieve sensitive stored data without any legitimate account. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the CWE-798 root cause makes exploitation mechanically trivial for any attacker within network reach of the database port.

Technical ContextAI

openssl_encrypt (CPE: cpe:2.3:a:jahlives:openssl_encrypt) is a PHP encryption library authored by jahlives that ships a standalone server component backed by PostgreSQL. CWE-798 (Use of Hard-coded Credentials) is the root cause class: static credentials are baked into configuration files distributed with the software rather than generated uniquely at installation time. Because PostgreSQL enforces authentication via username and password, hardcoded credentials entirely defeat this control - an attacker can extract the credential values from the published software package or the public GHSA advisory and authenticate as a trusted database user. The vulnerability spans all releases from version 0 up to, but not including, version 1.4.0, as confirmed by the EUVD affected version range.

RemediationAI

Upgrade openssl_encrypt to version 1.4.0 or later, which resolves the hardcoded credential issue per the vendor advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-v4vm-4xf2-fhqj. If an immediate upgrade is not feasible, immediately rotate all PostgreSQL credentials associated with the hardcoded values - note this requires database administrative access and may require application reconfiguration for legitimate connections. Restrict PostgreSQL network access via pg_hba.conf host-based authentication rules to permit only explicitly trusted IP addresses (trade-off: requires PostgreSQL admin access and may interrupt connections from new legitimate hosts if not carefully maintained). Network segmentation that isolates the PostgreSQL instance from untrusted network segments is a high-value compensating control that addresses the adjacent-network attack vector. Audit existing PostgreSQL logs for unauthorized authentication attempts using the known default credential values to assess whether exploitation has already occurred.