PT-2026-76615 · Unknown · Openssl-Encrypt
CVE-2026-74879
·
Published
2026-04-01
·
Updated
2026-08-17
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
openssl encrypt versions prior to 1.4.0
Description
An information disclosure issue exists in the '/ready' endpoint that allows unauthenticated callers to receive full database exception strings. By triggering database errors, attackers can extract sensitive data from these exception messages, including hostnames, IP addresses, connection parameters, and potentially credentials.
Recommendations
Update to version 1.4.0 or later.
Restrict access to the '/ready' endpoint to minimize the risk of exploitation.
Exploit
Fix
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openssl-Encrypt