External risk intelligence

Openssl Encrypt Insecure Random Import Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-74887

The vulnerability involves a code-level import of a non-cryptographic module in a Python library. It is a build-time or developer-side concern that does not expose a network service or a public-facing endpoint, as the issue resides in the source code rather than a reachable deployment configuration.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a library used for encryption that unintentionally imported a module not designed for secure random number generation. While no existing cryptographic functions are currently impacted, this import creates a potential risk if future development inadvertently uses this weaker random source, which could lead to predictable values in sensitive operations. The primary concern is to confirm if this library is in use and if the specific module is being leveraged in a way that could be exploited.

Unintended import of a weak random number generator.
Confirms relevance and exposure of this specific library.
Understand potential risks if library is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability if future code inadvertently uses a predictable random number generator instead of a secure one. This import creates a hazard that, if misused, could allow an attacker to recover predictable values, potentially impacting cryptographic operations. There is no evidence this vulnerability is currently being exploited or directly reachable by an attacker.

Code requires future misuse of import.
Vulnerability exists in library code.
Predictable values could impact crypto.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability relates to a Python library's import of a non-cryptographic random number generator, which could lead to predictable values if used in future cryptographic operations, though no current operations are affected.

Predictable values in future crypto.
Accidental use of insecure random.
Weakened cryptographic security.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the `openssl_encrypt` library, specifically the `pqc.py` module. Developers responsible for this library or applications using it are primarily accountable. The first practical step is to review the codebase for the import statement, determine if the `pqc.py` module is in use, and confirm the version of `openssl_encrypt`.

Identify developers using the library.
Verify usage of the `pqc.py` module.
Update the library to the fixed version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the openssl_encrypt library used for?

The openssl_encrypt library is a Python-based toolset designed to provide cryptographic capabilities for developers. It is specifically used to implement encryption and decryption functions within applications, including specialized modules for post-quantum cryptography (PQC) tasks.

Why is this CVE-2026-74887 vulnerability considered a weakness?

This issue is categorized under CWE-338: Use of a Cryptographically Weak Pseudo-Random Number Generator. The library unintentionally imports Python's standard 'random' module, which relies on the Mersenne Twister algorithm. Because this algorithm is not cryptographically secure, it can produce predictable sequences that, if accidentally utilized for security-sensitive operations, would allow an attacker to bypass protections.

How can an attacker trigger this vulnerability?

Currently, no direct path exists to trigger this vulnerability. The code simply contains an unnecessary import statement. It does not actively execute insecure functions today. Exploitation requires a future developer error where someone writes new code that intentionally or accidentally calls the weak 'random' module instead of a secure library like 'secrets' or 'os.urandom' for cryptographic purposes.

Do I need to worry about this if my app is internet-facing?

According to Halo Surface Signal, this is very unlikely to be an immediate risk. Because the vulnerability exists as a dormant code-level import rather than an exposed network service or reachable endpoint, it is primarily a developer-side concern. Your focus should be on internal software supply chain integrity rather than traditional perimeter-based threat hunting.

What is the recommended first step to respond?

The immediate priority is to identify where 'openssl_encrypt' is present in your development environment. Once located, verify if your project uses the 'pqc.py' module. If identified, the definitive fix is to upgrade to version 1.4.0 or later, which completely removes the insecure import, neutralizing the potential hazard for any future development.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.