CVE-2026-74886
Received Received - Intake

OpenSSL Encrypt Plugin Sandbox Bypass Vulnerability

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74886
EUVD
EUVD-2026-60105

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74886 is a plugin sandbox bypass vulnerability in openssl_encrypt versions before 1.4.0. It occurs due to a mismatch between the PluginImportGuard and the AST analyzer's blocked modules. The AST analyzer blocks more dangerous modules than the runtime import guard, allowing plugins to bypass security checks. Attackers can use string obfuscation or encoding to import unblocked modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.

Detection Guidance

To detect this vulnerability, check the version of openssl_encrypt installed on your system. Run: pip show openssl_encrypt or pip list | grep openssl_encrypt. If the version is below 1.4.0, the system is vulnerable.

Impact Analysis

If you use openssl_encrypt versions before 1.4.0, attackers could exploit this vulnerability to execute arbitrary code on your system. This could lead to data breaches, system compromise, or unauthorized access. The high CVSS scores (9.3 and 9.8) indicate significant risk of exploitation and impact.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to potential data breaches or unauthorized access. Organizations using vulnerable versions may face legal penalties, reputational damage, and loss of trust. The high severity of the flaw increases compliance risks.

Mitigation Strategies

Immediately upgrade openssl_encrypt to version 1.4.0 or later. Use: pip install --upgrade openssl_encrypt. Ensure the PluginImportGuard and AST analyzer block the same set of dangerous modules to prevent bypass.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74886. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart