CVE-2026-74873 in openssl_encrypt
Summary
by MITRE • 08/17/2026
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and keystore passwords.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in openssl_encrypt versions prior to 1.4.0 represents a significant information disclosure flaw rooted in the improper handling of command-line arguments during execution. When users invoke the tool with the --password flag, the provided password is passed directly as an argument to the operating system's process creation mechanism. In most Unix-like environments, including Linux and macOS, these arguments are stored in memory accessible via standard system interfaces such as /proc/[pid]/cmdline or can be enumerated using utilities like ps aux. This behavior means that any user account on the same system with read access to process information can inspect the command line of a running openssl_encrypt instance and extract sensitive credentials in plaintext, bypassing intended security controls designed to protect secret material from unauthorized observation.
From a technical perspective, this issue stems from how many traditional Unix applications handle input parameters. Rather than reading secrets from secure environment variables or standard input streams that are not logged by the shell or process monitor tools, the application accepts them as positional arguments. The operating system kernel retains these arguments in the task structure for debugging and management purposes, making them visible to other processes with appropriate permissions. This is a common pitfall in software development where convenience of implementation overrides security best practices regarding secret handling. The flaw allows local attackers or any compromised user on the multi-tenant host to harvest passwords used for encryption operations, including keystore passwords which are critical for maintaining the integrity and confidentiality of stored cryptographic keys.
The operational impact of this vulnerability is severe in shared hosting environments, continuous integration pipelines, or any scenario where multiple users share a single operating system instance. An attacker with low-level access can passively monitor running processes to capture these plaintext credentials without needing to exploit additional vulnerabilities such as buffer overflows or privilege escalation flaws. Once obtained, the passwords can be used immediately for unauthorized decryption of protected data or authentication against systems that reuse those same credentials. This undermines the fundamental security guarantees provided by encryption if the keys and access secrets are exposed through side-channel information leakage via process listings.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, specifically regarding the exposure of sensitive data through command-line arguments, and falls under MITRE ATT&CK technique T1059 Command and Scripting Interpreter for local reconnaissance or credential harvesting. To mitigate this risk, developers should avoid passing secrets via CLI arguments entirely. Instead, applications should support reading passwords from environment variables which are typically not exposed in process listings, or prompt the user interactively for input without echoing it to standard output or logging systems. For users of affected versions, immediate mitigation involves upgrading to openssl_encrypt version 1.4.0 or later where this behavior has been corrected. In environments where upgrade is not immediately feasible, restricting file permissions on /proc entries and using process accounting tools that mask arguments can provide limited protection, though these are workarounds rather than definitive fixes.