CVE-2026-74882

CRITICAL 9.1CVE-2026-74882 · GHSA-2592-7m3g-7fq6 · PYSEC-2026-3744 · Published 17/08/2026 · updated 31/08/2026

In short

CVE-2026-74882 is a CRITICAL (CVSS 9.1) vulnerability affecting openssl-encrypt, openssl encrypt (jahlives).
Chance of exploitation in the next 30 days (EPSS): 0.17%, higher than 5.9% of all vulnerabilities.
Fix: update to 1.4.0 or later.

Package	Affected versions	Patched versions
openssl-encrypt PyPI	`< 1.4.0`	`1.4.0`
openssl encrypt jahlives	`< 1.4.0`	`1.4.0`

Description

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

NVD description

References

jahlives/openssl_encrypt security advisory · ADVISORY
vulncheck.com/advisories/openssl-encrypt-before-insecure-default-configuration · ADVISORY

More vulnerabilities in openssl-encrypt

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openssl-encrypt

PyPI

< 1.4.0

1.4.0

openssl encrypt

jahlives

< 1.4.0

1.4.0

Description

NVD description

More vulnerabilities in openssl-encrypt

See all →