PT-2026-76615 · Unknown · Openssl-Encrypt

CVE-2026-74879

·

Published

2026-04-01

·

Updated

2026-08-17

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0
Description An information disclosure issue exists in the '/ready' endpoint that allows unauthenticated callers to receive full database exception strings. By triggering database errors, attackers can extract sensitive data from these exception messages, including hostnames, IP addresses, connection parameters, and potentially credentials.
Recommendations Update to version 1.4.0 or later. Restrict access to the '/ready' endpoint to minimize the risk of exploitation.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-74879
GHSA-2VHW-Q7VH-7XV2
PYSEC-2026-3758

Affected Products

Openssl-Encrypt