Insecure Default Configuration in openssl_encrypt Affects Security of Proxies

CVE-2026-74882

What is CVE-2026-74882?

The openssl_encrypt library prior to version 1.4.0 is susceptible to an insecure default configuration that allows it to trust the entire RFC 1918 private address space. This vulnerability can be exploited by attackers on the same private network to manipulate client certificate headers. If the ProxyAuth validation is weakened or altered, these attackers can successfully bypass mTLS authentication, leading to potential security breaches. Organizations utilizing this library should upgrade to ensure robust security measures are in place against such vulnerabilities.

References