CVE-2026-74896: openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal
opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use class, bases, subclasses(), and globals chains to access restricted functions and execute arbitrary system commands from plugin code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
Ensure plugin code runs inside a hardened sandbox/isolation boundary so that any attempt at __class__/__bases__/__subclasses__/__globals__ attribute traversal from plugin code cannot reach restricted functions or execute arbitrary system commands.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74896?
CVE-2026-74896 has been assessed with a critical severity rating of 9.8.
How do I fix CVE-2026-74896?
To resolve CVE-2026-74896, update to OpenSSL openssl_encrypt version 1.4.0 or later.
What systems are affected by CVE-2026-74896?
CVE-2026-74896 affects OpenSSL openssl_encrypt versions prior to 1.4.0.
What type of vulnerability is CVE-2026-74896?
CVE-2026-74896 is a sandbox escape vulnerability that involves dunder attribute traversal.
What are the potential consequences of exploiting CVE-2026-74896?
Exploiting CVE-2026-74896 may allow attackers to access restricted functions and execute arbitrary code.