CVE-2026-74891: openssl_encrypt before 1.4.0 Hardcoded Database Credentials
opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Operational
For any openssl_encrypt instances running versions before 1.4.0 that may contain hardcoded database credentials, rotate the exposed database credentials after upgrading to 1.4.0.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74891?
The severity of CVE-2026-74891 is rated as critical with a score of 9.8.
How do I fix CVE-2026-74891?
To fix CVE-2026-74891, update to OpenSSL openssl_encrypt version 1.4.0 or later.
What vulnerabilities are associated with CVE-2026-74891?
CVE-2026-74891 is associated with hardcoded database credentials that can be exploited by attackers on the same network.
What type of data is at risk with CVE-2026-74891?
CVE-2026-74891 puts sensitive data at risk, particularly from PostgreSQL databases.
Who is affected by CVE-2026-74891?
Any user or organization utilizing OpenSSL openssl_encrypt versions before 1.4.0 is affected by CVE-2026-74891.