CVE-2026-74892
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.
Risk Assessment
The risk is that telemetry API authentication can be compromised, potentially leading to unauthorized access to or manipulation of telemetry data.
Recommendation
It is recommended to upgrade openssl_encrypt to version 1.4.0 or later and change the default key to a unique value.
Original NVD description (English source)
openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.