CVE-2026-74870 jahlives CVE debrief

Who should care

Users of openssl_encrypt (pip) versions <= 1.4.7, particularly those using diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test', should review and update to version 1.4.8 or later to mitigate potential information exposure. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the secure use of openssl_encrypt (pip) in their environments.

Technical summary

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability. Diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test' unconditionally print the full derived hardware pepper as hex to stdout/stderr. The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, preventing its use for decrypting real files. Users should review and update to version 1.4.8 or later to mitigate potential information exposure.

Defensive priority

High-priority defensive review required for openssl_encrypt (pip) versions <= 1.4.7 due to information exposure vulnerability.

Recommended defensive actions

• Review and update openssl_encrypt (pip) to version 1.4.8 or later
• Restrict access to diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test'
• Monitor for and review terminal scrollback, session recordings, and CI logs for potential pepper exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page indicates information exposure vulnerability in openssl_encrypt (pip) versions <= 1.4.7. Diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test' print full derived hardware pepper as hex to stdout/stderr. Impact is limited due to salt-bound pepper. Further review of terminal scrollback, session recordings, and CI logs is recommended to verify potential pepper exposure and ensure proper mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.