The vulnerability CVE-2026-74879 affects the jahlives openssl_encrypt product in versions prior to 1.4.0. The /ready endpoint improperly exposes full database exception strings to unauthenticated callers, enabling information disclosure. Attackers can induce database errors to retrieve sensitive internal details including hostnames, IP addresses, connection parameters, and possibly credentials from the error messages. This flaw is classified as an information disclosure vulnerability with a CVSS 4.0 score of 8.7, indicating high severity. No known exploits are reported in the wild, and no official remediation or patch has been documented at this time.

Sensitive internal information such as database hostnames, IP addresses, connection parameters, and potentially credentials can be disclosed to unauthenticated attackers. This exposure could facilitate further attacks by revealing infrastructure details and access information. The vulnerability does not require authentication or user interaction to exploit and has a high severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /ready endpoint to trusted users or internal networks to prevent unauthenticated access. Monitor for any updates from the vendor regarding official patches or mitigations.