CVE-2026-74886: openssl_encrypt before 1.4.0 Plugin Import Guard Bypass
opensslencrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUSMODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
Ensure PluginImportGuard cannot be bypassed by string obfuscation/encoding; disallow importing any dangerous modules that AST analysis treats as dangerous (e.g., sys, shutil, multiprocessing, importlib, pickle) even if PluginImportGuard differs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74886?
CVE-2026-74886 has a critical severity rating of 9.8.
What does CVE-2026-74886 vulnerability imply?
CVE-2026-74886 allows attackers to bypass the Plugin Import Guard in openssl_encrypt versions before 1.4.0.
How do I fix CVE-2026-74886?
To fix CVE-2026-74886, upgrade to openssl_encrypt version 1.4.0 or later.
What types of attacks can exploit CVE-2026-74886?
CVE-2026-74886 can be exploited through string obfuscation or encoding techniques.
Which software is affected by CVE-2026-74886?
The vulnerability affects the openssl_encrypt component of OpenSSL used before version 1.4.0.