CVE-2026-74882: openssl_encrypt before 1.4.0 Insecure Default Configuration
opensslencrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trustedproxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0Patch before 1.4.0 - Configuration
In IntegrityProxyConfig, modify trusted_proxies to remove relaxed/trusting of the entire RFC 1918 private address space, so forged client certificate headers on private networks cannot bypass mTLS.
IntegrityProxyConfig trusted_proxies = Do not trust the entire RFC 1918 private address space; restrict to the specific, required proxy IPs
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74882?
CVE-2026-74882 has a severity rating of 7.5, indicating a high risk.
What are the risks associated with CVE-2026-74882?
The risk with CVE-2026-74882 includes the potential for attackers on private networks to forge client certificate headers and bypass mTLS authentication.
How do I fix CVE-2026-74882?
To fix CVE-2026-74882, upgrade OpenSSL to version 1.4.0 or later to eliminate the insecure default configuration.
Which versions of OpenSSL are affected by CVE-2026-74882?
CVE-2026-74882 affects all OpenSSL_encrypt versions prior to 1.4.0.
What does the integrity configuration issue in CVE-2026-74882 imply?
The integrity configuration issue in CVE-2026-74882 implies that the application trusts all RFC 1918 private addresses, creating vulnerabilities in mTLS processes.