Every CVE Search/ Get API key

CVE-2026-74879

openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

8.7 HighFix available

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.44%Up 0.2 points since Aug 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Record
CVE-2026-74879
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
EUVDEUVD-2026-60098 8.7

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Record
EUVD-2026-60098
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2vhw-q7vh-7xv2 6.6

openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers

Summary

The /ready endpoint in openssl_encrypt_server/server.py at lines 159-175 catches database errors and returns the full exception string in the response.

Affected Code

except Exception as e:
    return {"status": "not_ready", "reason": str(e)}

Impact

Database exception messages can leak:

  • Database hostnames and IP addresses
  • Connection parameters and port numbers
  • Driver version information
  • Potentially database credentials if included in connection string errors

This information is available to unauthenticated callers.

Recommended Fix

  • Return a generic error message: {"status": "not_ready", "reason": "database unavailable"}
  • Log the full exception server-side for debugging

Fix

Fixed in commit 7aa8787 on branch releases/1.4.x — replaced str(e) with generic "database check failed" message; full exception logged server-side at WARNING level.

Record
GHSA-2vhw-q7vh-7xv2
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-201
Updated
2026-11-02
GitHub AdvisoriesGHSA-r654-xcxm-6jpc 8.7

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the ...

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Record
GHSA-r654-xcxm-6jpc
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
NVD 8.7

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Record
CVE-2026-74879
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
OSV 8.7

openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Record
CVE-2026-74879
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-209
Updated
2026-11-02
OSVGHSA-2vhw-q7vh-7xv2 6.6

openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers

Summary

The /ready endpoint in openssl_encrypt_server/server.py at lines 159-175 catches database errors and returns the full exception string in the response.

Affected Code

except Exception as e:
    return {"status": "not_ready", "reason": str(e)}

Impact

Database exception messages can leak:

  • Database hostnames and IP addresses
  • Connection parameters and port numbers
  • Driver version information
  • Potentially database credentials if included in connection string errors

This information is available to unauthenticated callers.

Recommended Fix

  • Return a generic error message: {"status": "not_ready", "reason": "database unavailable"}
  • Log the full exception server-side for debugging

Fix

Fixed in commit 7aa8787 on branch releases/1.4.x — replaced str(e) with generic "database check failed" message; full exception logged server-side at WARNING level.

Record
GHSA-2vhw-q7vh-7xv2
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-201
Updated
2026-11-02
OSVPYSEC-2026-3758 8.7

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Record
PYSEC-2026-3758
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl-encrypt
PyPI
 before 1.4.0
1.4.0
openssl-encrypt
PyPI
 before 1.4.0, plus listed versions
0.2.20.2.30.2.40.2.50.2.6
Show 39 moreShow less
0.3.00.3.10.3.20.3.30.4.00.4.10.4.20.4.30.4.40.5.00.5.10.5.30.6.0rc10.7.0rc20.7.10.7.20.8.00.8.10.8.20.9.21.0.01.0.11.0.21.0.31.1.01.2.01.2.11.3.01.3.11.3.21.3.31.3.41.3.51.4.0b31.4.0b41.4.0b51.4.0b61.4.0b71.4.0b8
1.4.0

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-74879 is a high vulnerability (CVSS 8.7) in Jahlives Openssl Encrypt, published April 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in openssl-encrypt 1.4.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open