CVE-2026-74882
Received Received - Intake

OpenSSL Encrypt Default Trusts RFC 1918 Private Networks

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74882
EUVD
EUVD-2026-60101

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.0. It involves an insecure default configuration in IntegrityProxyConfig that automatically trusts all private RFC 1918 IP addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Attackers on the same private network can forge client certificate headers to bypass mutual TLS authentication if ProxyAuth validation is weakened or altered.

Detection Guidance

Check if your openssl_encrypt version is below 1.4.0 by running: openssl_encrypt --version. Inspect the IntegrityProxyConfig trusted_proxies setting in openssl_encrypt_server/config.py for RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

Verify ProxyAuth validation rules to ensure they reject networks with prefixes shorter than /24.

Impact Analysis

If you use openssl_encrypt versions before 1.4.0, attackers on your private network could impersonate legitimate users by forging client certificate headers. This bypasses mTLS authentication, potentially allowing unauthorized access to sensitive data or systems protected by this configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating compliance requirements for data protection such as GDPR (which mandates strict access controls) and HIPAA (which requires safeguards for protected health information). A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later immediately to apply the patch that restricts trusted_proxies to localhost only.

Manually update the IntegrityProxyConfig trusted_proxies setting to only include 127.0.0.1 and ::1 if upgrading is not possible.

Review and tighten ProxyAuth validation rules to ensure they reject any relaxed or modified configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74882. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart