CVE-2026-74877: openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key
opensslencrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revokekey method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0Patch Missing Ownership Verification via revoke_key
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74877?
CVE-2026-74877 has a severity rating of high at 8.8.
How do I fix CVE-2026-74877?
To fix CVE-2026-74877, upgrade OpenSSL_encrypt to version 1.4.0 or later.
What impact does CVE-2026-74877 have on my systems?
CVE-2026-74877 allows authenticated clients to revoke other clients' keys, potentially compromising security.
Who is affected by CVE-2026-74877?
All users of OpenSSL_encrypt versions before 1.4.0 are affected by CVE-2026-74877.
How was CVE-2026-74877 discovered?
CVE-2026-74877 was identified due to a failure in the revoke_key method to perform necessary ownership verifications.