CVE-2026-74877
Received Received - Intake

OpenSSL Encrypt Missing Ownership Verification in Key Revocation

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74877
EUVD
EUVD-2026-60096

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74877 is a missing ownership verification vulnerability in openssl_encrypt versions before 1.4.0. The revoke_key method allows authenticated clients to revoke any other client's key by providing a valid ML-DSA signature, bypassing intended ownership restrictions.

Detection Guidance

To detect this vulnerability, check the version of openssl_encrypt installed on your system. Run: openssl_encrypt --version. If the version is below 1.4.0, the system is vulnerable. Additionally, monitor logs for unauthorized revoke_key method calls or unexpected key revocations.

Impact Analysis

Attackers with valid signatures could revoke legitimate users' keys, causing service disruptions or unauthorized access loss. Systems relying on key revocation for security may face integrity and availability issues.

Compliance Impact

This vulnerability could lead to unauthorized key revocations, potentially violating data integrity and access control requirements in GDPR and HIPAA. Non-compliance may result if systems fail to protect cryptographic keys adequately.

Mitigation Strategies

Immediately upgrade openssl_encrypt to version 1.4.0 or later. If upgrading is not possible, restrict access to the revoke_key method and implement additional authorization checks to verify key ownership before processing revocation requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74877. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart