---
cve: "CVE-2026-74879"
severity: "HIGH"
cvss: 8.7
epss: "0.4%"
vendor: "jahlives"
kev: false
exploited: false
published: "2026-08-17 11:16:42"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-01T19:10:52+01:00"
---

# CVE-2026-74879

> 8.7 HIGH · 🧪 PoC

## Beschreibung

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-08 15:24:51
- CNA-CVSS: **8.7** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-209** — Generation of Error Message Containing Sensitive Information
  The product generates an error message that includes sensitive information about its environment, users, or associated data.

## Angriffsmuster (CAPEC)

- [CAPEC-7 — Blind SQL Injection](https://capec.mitre.org/data/definitions/7.html) _(Severity: High)_
- [CAPEC-54 — Query System for Information](https://capec.mitre.org/data/definitions/54.html) _(Severity: Low)_
- [CAPEC-215 — Fuzzing for application mapping](https://capec.mitre.org/data/definitions/215.html) _(Severity: Low)_
- [CAPEC-463 — Padding Oracle Crypto Attack](https://capec.mitre.org/data/definitions/463.html) _(Severity: High)_

## Patch verfügbar (OSV)

- 768df5cd1910e349509f07a27eeac6951e0003bf (Commit)

## Referenzen

- <https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2vhw-q7vh-7xv2>
- <https://www.vulncheck.com/advisories/openssl-encrypt-before-information-disclosure-via-ready-endpoint>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-74879/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_