Information Exposure in OpenSSL Encrypt Versions by Jahlives

CVE-2026-74870

What is CVE-2026-74870?

The OpenSSL Encrypt library versions up to 1.4.7 are vulnerable to an information exposure issue where specific diagnostic commands, namely 'hsm fido2-test' and 'hsm onlykey-test', reveal sensitive information by printing the full derived hardware pepper to standard output and error logs. This leaked information can persist in terminal scrollback history, session recordings, and CI logs, posing a risk in certain environments. Although the actual impact is limited due to the nature of the derived pepper being salt-bound and non-reusable for decrypting files, the information leak represents a significant oversight in safeguarding sensitive cryptographic information. The issue has been addressed in versions 1.4.8 and 1.5.0, which eliminate the unnecessary output by routing plugin debug information through a secure redaction layer.

References