CVE-2026-74887: openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module
opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encrypt/modules/pqc.pyto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74887?
The severity of CVE-2026-74887 is classified as low.
What is the main issue with CVE-2026-74887?
CVE-2026-74887 involves an insecure random import in the PQC module of openssl_encrypt versions before 1.4.0.
How do I mitigate the risks associated with CVE-2026-74887?
To mitigate risks associated with CVE-2026-74887, upgrade to version 1.4.0 or later of openssl_encrypt.
Does CVE-2026-74887 affect cryptographic operations?
No, CVE-2026-74887 does not currently affect any cryptographic operations directly.
What is the cause of CVE-2026-74887?
CVE-2026-74887 is caused by the import of Python's non-cryptographic 'random' module in the openssl_encrypt code.