CVE-2026-74873
Received Received - Intake

OpenSSL CLI Password Exposure via Process Listings

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74873
EUVD
EUVD-2026-60092

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-214 A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74873 is a vulnerability in openssl_encrypt versions before 1.4.0 where passwords passed via the --password CLI argument are exposed in system process listings. Attackers can view these passwords by running commands like ps aux or checking /proc/[pid]/cmdline, potentially exposing plaintext passwords and keystore passwords.

Detection Guidance
  • Check running processes for exposed passwords using commands like 'ps aux | grep --password' or inspect '/proc/[pid]/cmdline' for the vulnerable openssl_encrypt command with --password or --keystore-password arguments.
  • Verify if the openssl_encrypt version is below 1.4.0, as versions before this are vulnerable.
Impact Analysis

On multi-user systems, any user can retrieve passwords by listing running processes. This could lead to unauthorized access to encrypted data, keystores, or sensitive information if attackers exploit the exposed passwords.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive passwords. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Password exposure violates these standards by allowing unauthorized access to encrypted data.

Mitigation Strategies
  • Upgrade openssl_encrypt to version 1.4.0 or later to address the vulnerability.
  • Replace usage of --password or --keystore-password CLI arguments with more secure alternatives like --password-file, --password-fd, or interactive password prompting.
  • Avoid passing passwords via environment variables like CRYPT_PASSWORD, as they may also be exposed in /proc/[pid]/environ.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74873. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart