The vulnerability CVE-2026-74873 affects jahlives openssl_encrypt versions prior to 1.4.0. When users supply passwords via the --password CLI argument, these passwords are visible in process listings accessible to all system users. This occurs because the password is passed as a command line argument, which can be read by other users through standard system utilities such as ps aux or by examining the /proc filesystem. The CVSS 4.0 base score is 8.7, indicating a high-severity issue with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

The vulnerability allows any local user on the system to obtain plaintext passwords and keystore passwords by viewing the command line arguments of running openssl_encrypt processes. This leads to a high confidentiality impact as sensitive credentials can be exposed without requiring privileges or user interaction. The integrity and availability impacts are not affected. The exposure of sensitive information could facilitate further attacks if attackers gain access to these passwords.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid passing sensitive passwords via the --password CLI argument to prevent exposure in process listings. Alternative secure methods of providing passwords should be used, such as environment variables or protected input prompts, if supported by the software.