CVE-2026-74892
openssl_encrypt before 1.4.0 Hardcoded Secret Key
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 17, 2026
- Updated
- Oct 1, 2026
- Reserved
- Aug 17, 2026
Description
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
openssl_encryptjahlives |
|
References
- GitHub Security Advisory (GHSA-p926-6hjp-w9jw)vendor-advisory
- VulnCheck Advisory: openssl_encrypt before 1.4.0 Hardcoded Secret Keythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.