CVE-2026-74873: openssl_encrypt before 1.4.0 Password Exposure via CLI Argument
opensslencrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
Ensure system users cannot read process listings/command lines (e.g., restrict access to process information sources such as `ps aux` and `/proc/[pid]/cmdline`) on affected systems where `openssl_encrypt` < 1.4.0 is running.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74873?
CVE-2026-74873 has a medium severity rating of 5.5.
How do I fix CVE-2026-74873?
To fix CVE-2026-74873, upgrade to OpenSSL Encrypt version 1.4.0 or later.
What is the risk associated with CVE-2026-74873?
The risk associated with CVE-2026-74873 is that passwords passed via the CLI can be exposed to other system users.
Which versions of OpenSSL are affected by CVE-2026-74873?
OpenSSL Encrypt versions before 1.4.0 are affected by CVE-2026-74873.
How can attackers exploit CVE-2026-74873?
Attackers can exploit CVE-2026-74873 by reading process arguments through tools like ps aux or accessing /proc/[pid]/cmdline.