CVE-2026-74870
Received Received - Intake

Information Exposure in openssl_encrypt Python Library

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74870
EUVD
EUVD-2026-60089

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in openssl_encrypt versions before 1.4.8. Diagnostic commands like 'hsm fido2-test' and 'hsm onlykey-test' unconditionally printed the full derived hardware pepper as hexadecimal to stdout or stderr. This exposed value could persist in terminal logs, session recordings, or CI logs.

Detection Guidance

Check if you are using openssl_encrypt versions <= 1.4.7. Run commands like 'pip show openssl_encrypt' to verify the installed version. Look for diagnostic command outputs in logs or terminal history that may contain hexadecimal pepper values from 'hsm fido2-test' or 'hsm onlykey-test'.

Impact Analysis

The impact is limited because the exposed pepper is derived from a random per-invocation test salt and is salt-bound, so it cannot be used to decrypt real files. However, the hardware-derived key material exposure could pose risks if it ends up in logs or recordings.

Compliance Impact

This vulnerability involves exposure of hardware-derived key material (pepper) through diagnostic commands, which could be logged in terminal scrollback, session recordings, or CI logs. While the exposed pepper is salt-bound and unusable for decrypting real files, its disclosure may still violate data protection principles under GDPR and HIPAA by exposing sensitive cryptographic material. Organizations using affected versions should review logging practices and update to patched versions to maintain compliance.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.8 or later (or 1.5.0). Remove any exposed pepper values from logs, terminal scrollback, or CI logs. Ensure no sensitive data remains in session recordings or debug outputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart