CVE-2026-74892: openssl_encrypt before 1.4.0 Hardcoded Secret Key

Q: What is the severity of CVE-2026-74892?

CVE-2026-74892 has a high severity rating of 7.5.

Q: How do I fix CVE-2026-74892?

To fix CVE-2026-74892, upgrade to OpenSSL encrypt version 1.4.0 or later.

Q: What are the risks associated with CVE-2026-74892?

The risks associated with CVE-2026-74892 include potential API key compromise due to predictable hashing.

Q: What versions are affected by CVE-2026-74892?

CVE-2026-74892 affects OpenSSL encrypt versions prior to 1.4.0.

Q: Can CVE-2026-74892 lead to unauthorized access?

Yes, CVE-2026-74892 can allow attackers to forge API key hashes, leading to unauthorized access.

Published Aug 17, 2026

Updated

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

Affected Software

1 affected component

OpenSSL openssl_encrypt<1.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade standalone telemetry server configuration (openssl_encrypt) to a version that resolves this vulnerability.
Fixed in 1.4.0

Event History

Aug 17, 2026

CVE Published

via MITRE·11:04 AM

Data Sourced

via MITRE·11:04 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:16 AM

DescriptionSeverityWeakness

Oct 7, 58596

Event

via NVD·11:44 AM

Frequently Asked Questions

What is the severity of CVE-2026-74892?

CVE-2026-74892 has a high severity rating of 7.5.

How do I fix CVE-2026-74892?

To fix CVE-2026-74892, upgrade to OpenSSL encrypt version 1.4.0 or later.

What are the risks associated with CVE-2026-74892?

The risks associated with CVE-2026-74892 include potential API key compromise due to predictable hashing.

What versions are affected by CVE-2026-74892?