CVE-2026-74877

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0

Description Authenticated clients can revoke keys belonging to other clients due to a lack of ownership verification in the revoke key() method. An attacker can bypass ownership restrictions and revoke arbitrary keys by providing a valid ML-DSA signature.

Recommendations Update openssl encrypt to version 1.4.0 or later. As a temporary workaround, restrict access to the revoke key() method to minimize the risk of unauthorized key revocation.