CVE-2026-74891 identifies a vulnerability in the jahlives project’s openssl_encrypt component where versions before 1.4.0 include hardcoded database credentials within standalone server configuration files. This flaw enables attackers with network access to authenticate to PostgreSQL databases using these well-known default credentials, potentially leading to unauthorized data access. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Attackers on the same network can leverage the hardcoded credentials to connect to PostgreSQL databases and retrieve sensitive information without needing any privileges or user interaction. This compromises confidentiality of the database contents. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid deploying affected versions in environments where untrusted network access is possible. Consider restricting network access to the database and replacing default credentials if feasible.