Plugin Sandbox Bypass in OpenSSL_Encrypt by OpenSSL

CVE-2026-74886

What is CVE-2026-74886?

The OpenSSL_Encrypt library, prior to version 1.4.0, suffers from a plugin sandbox bypass vulnerability. This issue arises when the PluginImportGuard restricts access to a different set of modules compared to the DANGEROUS_MODULES designated by the AST analyzer. Malicious actors can exploit this flaw by leveraging string obfuscation or encoding techniques, enabling them to import unrestricted hazardous modules such as sys, shutil, multiprocessing, importlib, and pickle. This can lead to arbitrary code execution, posing a significant risk to affected systems. It is crucial for users of OpenSSL_Encrypt to ensure they update to a secure version to mitigate this vulnerability.

References