CVE-2026-74892
Received Received - Intake

Hard-Coded Secret Key in OpenSSL Telemetry Server

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74892
EUVD
EUVD-2026-60111

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hardcoded default secret key in the standalone telemetry server configuration of openssl_encrypt versions before 1.4.0. The default key is set to 'CHANGE_THIS_IN_PRODUCTION' and is used for API key hashing. Attackers who know this default value can predict or forge API key hashes, compromising telemetry API authentication.

Detection Guidance

Check if your openssl_encrypt version is below 1.4.0 by running: openssl_encrypt --version. Inspect config.py for the hardcoded default secret key 'CHANGE_THIS_IN_PRODUCTION' at line 34. Search for this string in your codebase to identify affected configurations.

Impact Analysis

Attackers could exploit this vulnerability to forge API key hashes, gaining unauthorized access to telemetry APIs. This could lead to data breaches, unauthorized data manipulation, or service disruption if the telemetry system is compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face compliance violations, legal penalties, and reputational damage if such breaches occur due to this flaw.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.0 or later. Remove the default secret key from config.py and set a strong, unique secret. Ensure the application fails to start if the secret is unset or matches the default. Generate a random secret on first startup.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74892. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart