CVE-2026-74879: openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint
opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74879?
CVE-2026-74879 has a severity rating of 7.5, indicating it is a high risk vulnerability.
How do I fix CVE-2026-74879?
To fix CVE-2026-74879, upgrade openssl_encrypt to version 1.4.0 or later.
What types of information can be disclosed due to CVE-2026-74879?
CVE-2026-74879 can lead to the disclosure of sensitive information such as hostnames, IP addresses, and database connection details.
What component is affected by CVE-2026-74879?
CVE-2026-74879 affects the openssl_encrypt software, specifically through its /ready endpoint.
Is authentication required to exploit CVE-2026-74879?
No authentication is required to exploit CVE-2026-74879 as it can be triggered by unauthenticated users.