CVE-2026-74870

The record

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

Affected packages

Related vulnerabilities

• CVE-2026-16648 Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log… CWE-532
• CVE-2026-104872 OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting… CWE-532
• CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-532
• CVE-2026-87993 The consul-template library is vulnerable to an information disclosure issue in its error… CWE-532
• CVE-2026-80169 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-532
• CVE-2026-79966 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-532
• CVE-2026-86597 Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC… CWE-532
• CVE-2026-86501 In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to… CWE-532