CVE-2026-74879: Generation of Error Message Containing Sensitive Information in jahlives openssl_encrypt
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
AI Analysis
Technical Summary
The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 involves the generation of error messages containing sensitive information. Specifically, the /ready endpoint returns detailed database exception strings without authentication, enabling attackers to induce database errors and retrieve sensitive internal details including hostnames, IP addresses, connection parameters, and possibly credentials. This exposure can lead to significant information disclosure risks.
Potential Impact
The vulnerability allows unauthenticated attackers to obtain sensitive internal information from database error messages. This can aid attackers in reconnaissance and potentially facilitate further attacks by revealing critical infrastructure details and credentials. The CVSS 4.0 score of 8.7 reflects a high severity due to the network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the /ready endpoint and sanitize error messages to avoid leaking sensitive information.
CVE-2026-74879: Generation of Error Message Containing Sensitive Information in jahlives openssl_encrypt
Description
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.
CVSS v4.0
Score 8.7high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in jahlives openssl_encrypt prior to version 1.4.0 involves the generation of error messages containing sensitive information. Specifically, the /ready endpoint returns detailed database exception strings without authentication, enabling attackers to induce database errors and retrieve sensitive internal details including hostnames, IP addresses, connection parameters, and possibly credentials. This exposure can lead to significant information disclosure risks.
Potential Impact
The vulnerability allows unauthenticated attackers to obtain sensitive internal information from database error messages. This can aid attackers in reconnaissance and potentially facilitate further attacks by revealing critical infrastructure details and credentials. The CVSS 4.0 score of 8.7 reflects a high severity due to the network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the /ready endpoint and sanitize error messages to avoid leaking sensitive information.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-17T10:36:18.505Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a82f003bf8831d539c4831a
Added to database: 08/17/2026, 11:26:59 UTC
Last enriched: 08/17/2026, 11:43:21 UTC
Last updated: 08/17/2026, 17:31:50 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.