PYSEC-2026-3767

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

PYSEC-2026-3759

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

PYSEC-2026-3956

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...

PYSEC-2026-3753

opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...

PYSEC-2026-3753

opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...

PYSEC-2026-3956

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...

EUVD-2026-60116

opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec builtins. Attackers can traverse the Python class hierarchy via class.mro.subclasses to access system functions and execute arbitrary OS comman...

EUVD-2026-60110

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

CVE-2026-74880

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

CVE-2026-74879 openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74873 openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...

CVE-2026-74873 openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...

CVE-2026-74873

The openssl_encrypt tool (before v1.4.0) passes --password values as visible process arguments, retrievable by any local user via ps aux or /proc/[pid]/cmdline, exposing plaintext and keystore passwords. CVSS 5.5 (local) / 8.7 (network). Upgrade to v1.4.0 or pass passwords via stdin/env instead o...

EUVD-2026-60092

opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...

CVE-2026-74873 openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...

CVE-2026-74873

opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/pid/cmdline to retrieve plaintext passwords and keystore passwords...

EUVD-2026-60089

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...