Every CVE Search/ Get API key

CVE-2026-74873

openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

8.7 HighFix available

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.32%Up 0.1 points since Aug 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Record
CVE-2026-74873
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-214
Updated
2026-11-02
EUVDEUVD-2026-60092 8.7

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Record
EUVD-2026-60092
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-h3m5-p59h-x88p 6.6

openssl-encrypt has visible password in process list via --password CLI argument

Summary

Passwords passed via the --password / -p CLI argument in openssl_encrypt/modules/crypt_cli_subparser.py at lines 150-154 are visible to any user on the system via ps aux or /proc/[pid]/cmdline.

Affected Code

subparser.add_argument(
    "--password", "-p",
    help="Password (will prompt if not provided, or use CRYPT_PASSWORD environment variable)",
)

Similarly, --keystore-password exposes the keystore password.

Impact

On multi-user systems, any user can observe the encryption password by listing processes. The CRYPT_PASSWORD environment variable alternative is also visible via /proc/[pid]/environ (though with slightly restricted access).

Recommended Fix

  • Document the security implications prominently
  • Recommend interactive prompting (already supported) as the secure default
  • Consider supporting password file descriptors (--password-fd) or reading from stdin
  • Consider marking the argument as deprecated in favor of interactive prompting

Fix

Fixed in commit e78a366 on branch releases/1.4.x — added --password-file and --password-fd arguments; added OPENSSL_ENCRYPT_PASSWORD env var support; --password now emits deprecation warning.

Record
GHSA-h3m5-p59h-x88p
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-256
Updated
2026-11-02
GitHub AdvisoriesGHSA-jxvv-jp94-p77v 8.7

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in...

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Record
GHSA-jxvv-jp94-p77v
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-214
Updated
2026-11-02
NVD 8.7

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Record
CVE-2026-74873
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-214
Updated
2026-11-02
OSV 8.7

openssl_encrypt before 1.4.0 Password Exposure via CLI Argument

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Record
CVE-2026-74873
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-214
Updated
2026-11-02
OSVGHSA-h3m5-p59h-x88p 6.6

openssl-encrypt has visible password in process list via --password CLI argument

Summary

Passwords passed via the --password / -p CLI argument in openssl_encrypt/modules/crypt_cli_subparser.py at lines 150-154 are visible to any user on the system via ps aux or /proc/[pid]/cmdline.

Affected Code

subparser.add_argument(
    "--password", "-p",
    help="Password (will prompt if not provided, or use CRYPT_PASSWORD environment variable)",
)

Similarly, --keystore-password exposes the keystore password.

Impact

On multi-user systems, any user can observe the encryption password by listing processes. The CRYPT_PASSWORD environment variable alternative is also visible via /proc/[pid]/environ (though with slightly restricted access).

Recommended Fix

  • Document the security implications prominently
  • Recommend interactive prompting (already supported) as the secure default
  • Consider supporting password file descriptors (--password-fd) or reading from stdin
  • Consider marking the argument as deprecated in favor of interactive prompting

Fix

Fixed in commit e78a366 on branch releases/1.4.x — added --password-file and --password-fd arguments; added OPENSSL_ENCRYPT_PASSWORD env var support; --password now emits deprecation warning.

Record
GHSA-h3m5-p59h-x88p
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-256
Updated
2026-11-02
OSVPYSEC-2026-3753 8.7

openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.

Record
PYSEC-2026-3753
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl-encrypt
PyPI
 before 1.4.0
1.4.0
openssl-encrypt
PyPI
 before 1.4.0, plus listed versions
0.2.20.2.30.2.40.2.50.2.6
Show 39 moreShow less
0.3.00.3.10.3.20.3.30.4.00.4.10.4.20.4.30.4.40.5.00.5.10.5.30.6.0rc10.7.0rc20.7.10.7.20.8.00.8.10.8.20.9.21.0.01.0.11.0.21.0.31.1.01.2.01.2.11.3.01.3.11.3.21.3.31.3.41.3.51.4.0b31.4.0b41.4.0b51.4.0b61.4.0b71.4.0b8
1.4.0

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-74873 is a high vulnerability (CVSS 8.7) in Jahlives Openssl Encrypt, published March 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in openssl-encrypt 1.4.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open