---
id: CVE-2026-74892
title: openssl_encrypt before 1.4.0 Hardcoded Secret Key
summary: >-
  openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key
  in the standalone telemetry server configuration that is used for API key
  hashing. Attackers who know this default value can predict or forge API key
  hashes to …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-798
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-18T14:39:31.354253Z'
published: '2026-08-17'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:21:01.848Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74892'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p926-6hjp-w9jw
    label: GitHub Security Advisory (GHSA-p926-6hjp-w9jw)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-hardcoded-secret-key
    label: 'VulnCheck Advisory: openssl_encrypt before 1.4.0 Hardcoded Secret Key'
tags:
  - cve.org
  - osv
  - pip
epss: 0.00509
epssPercentile: 0.43263
aliases:
  - PYSEC-2026-3746
  - GHSA-p926-6hjp-w9jw
ecosystem: pip
patched:
  - openssl-encrypt 1.4.0
ingestedAt: '2026-09-02T19:31:24.796Z'
---

## Overview

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

## Affected

- `openssl_encrypt < 1.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-74892)

Affected packages:

- `openssl-encrypt < 1.4.0`

Patched in:

- `openssl-encrypt 1.4.0`

Source: https://osv.dev/vulnerability/PYSEC-2026-3746