CVE-2026-74870: openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure
opensslencrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (cryptcli.py, handlehsmcommand). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prfdata outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.5.0 - Configuration
In openssl_encrypt versions <= 1.4.7, remove the unconditional printing of the full derived hardware pepper hex in the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands (crypt_cli.py, handle_hsm_command) by routing any plugin debug output through the secret-redaction layer (fixed in 1.4.8 and 1.5.0).
openssl_encrypt (pip) diagnostic commands: 'hsm fido2-test' and 'hsm onlykey-test' (crypt_cli.py, handle_hsm_command) debug output / hex dumps routing through secret-redaction layer = remove hex dumps and route plugin debug output through redaction layer
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74870?
The severity of CVE-2026-74870 is classified as low with a score of 3.3.
What software is affected by CVE-2026-74870?
CVE-2026-74870 affects openssl_encrypt versions before 1.4.8.
How do I fix CVE-2026-74870?
To fix CVE-2026-74870, upgrade openssl_encrypt to version 1.4.8 or later.
What type of vulnerability is CVE-2026-74870?
CVE-2026-74870 is an information exposure vulnerability.
What can be the impact of CVE-2026-74870?
The impact of CVE-2026-74870 can include unauthorized disclosure of the derived hardware pepper value.