PYSEC-2026-3746

vendorUSosv

view advisory published 2026-08-17Licence: CC-BY-4.0

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-74892US	—OT elevated	0.51% (43rd)	—	2026-08-17
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know t…

references

External citations — patches, advisories, analysis.

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-p926-6hjp-w9jwADVISORY
https://www.vulncheck.com/advisories/openssl-encrypt-before-hardcoded-secret-keyADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan