External risk intelligence

openssl_encrypt Unverified Key Bundle Encryption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-74876

The vulnerability exists in a library function (PublicKeyBundle.from_dict) used to handle cryptographic keys. While it is network-reachable if an application uses this function to process untrusted user-supplied input, it is not inherently a public-facing service, gateway, or edge component by design.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability within the `openssl_encrypt` library affecting its handling of cryptographic key bundles. The flaw allows for the creation of key bundles from untrusted data without proper signature verification, potentially enabling attackers to encrypt sensitive data using compromised keys, leading to unauthorized access and information leakage.

Key bundles can be created without verifying signatures.
It may allow unauthorized encryption and secret leakage.
Confirm relevance and potential exposure to sensitive data.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending specially crafted data to an application that uses the vulnerable `openssl_encrypt` library. The application would process this data without verifying cryptographic signatures, allowing the attacker to create their own key bundles. This bypass of signature verification enables the attacker to encrypt sensitive information using keys they control, leading to data exposure.

Network exposure required.
Call `from_dict` without signature checks.
Encrypt data with attacker-controlled keys.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to encrypt sensitive data using a public key they control, bypassing signature verification. This could lead to the exposure of secrets when processing untrusted data with specific library functions.

Attacker-controlled public keys.
Processing untrusted data.
Leakage of encrypted secrets.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for applications utilizing the `openssl_encrypt` library, particularly those processing untrusted data for key bundling, should investigate this vulnerability. The first practical step involves identifying all instances of the affected library, confirming its reachability and business criticality, and then determining the accountable application or platform owner to plan remediation.

Application owners should own the issue.
Verify untrusted data processing.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the openssl_encrypt library and why is it used?

The openssl_encrypt library is a software component designed to help developers implement cryptographic functions within their applications. It is commonly used to manage security tasks like creating and organizing key bundles, which are collections of cryptographic keys needed for secure data operations. By providing these tools, the library enables programs to protect sensitive information during storage or transmission.

How does the CVE-2026-74876 vulnerability work?

This vulnerability involves a weakness class known as Improper Verification of Cryptographic Signature (CWE-347). It occurs when the PublicKeyBundle.from_dict() function processes input data without confirming its authenticity. Because the software fails to verify the digital signature, it accepts untrusted key data as valid. This allows an attacker to inject their own keys, misleading the application into encrypting data using keys the attacker controls.

When does this vulnerability pose a risk to an application?

A risk exists when an application uses the vulnerable library to process external, untrusted input through the from_dict() function. The vulnerability is not triggered if the library is only used to process internal, hardcoded, or already-validated data. It specifically requires an attacker to successfully supply specially crafted data that the application then passes into the compromised key bundle creation process.

Is my system exposed to CVE-2026-74876?

Halo Surface Signal indicates this is a 'Possible' risk. While the flaw is network-reachable if an application processes untrusted user input, the library itself is not automatically a public-facing service. You should determine if your application calls PublicKeyBundle.from_dict() on data provided by users or external networks. If the library is used only in isolated, internal logic that does not handle user-supplied data, the risk of exploitation is significantly lower.

What should I do if my applications use openssl_encrypt?

First, locate all applications within your environment that include the vulnerable versions of the library. Once identified, evaluate whether these applications pass untrusted network data into the PublicKeyBundle.from_dict() function. If they do, coordinate with the application owners to assess the data's sensitivity and plan a path to update or replace the library to a version where this signature verification logic is correctly implemented.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.