CVE-2026-74881 is a medium severity (CVSS 6.5) CORS misconfiguration in the openssl_encrypt Python package before 1.4.0. The servers allow any origin together with credentials, so a malicious website can make authenticated requests for a visitor. Upgrade to 1.4.0 and set explicit origins.
What's affected
The pip package openssl_encrypt, versions before 1.4.0. The GitHub advisory says the fix is in commit 809416b on the releases/1.4.x branch, which changes the CORS default from a wildcard to an empty list for the key server and the telemetry server. It also adds a check that rejects a wildcard when debug mode is off.
The affected pieces are the standalone key server and telemetry server, not the encryption command line tool. The example environment file and the docker-compose file also defaulted the setting to a wildcard, so copied configuration may carry it forward after an upgrade.
How to check if you're exposed
Check the installed version.
pip show openssl_encrypt
Then check your server configuration for the setting.
grep -rn "CORS_ORIGINS" .env docker-compose.yml
If you find a wildcard, replace it with the exact origins that need access.
What to do now
- Upgrade openssl_encrypt to 1.4.0 or later.
- Set CORS_ORIGINS to explicit origins, and remove any wildcard from environment files and compose files.
- Do not combine a wildcard origin with credentials in any service.
- Restart the key server and telemetry server after changing configuration.
- Review access logs for cross-origin requests from sites you do not recognize.
Why it matters
The record maps this to CWE-942, overly permissive cross-domain whitelist. Browsers block one site from reading another site's responses unless the second site opts in through CORS. Allowing every origin while also allowing credentials removes that protection, so a page on any site can act as the visitor on your API.
Most frameworks and browsers try to prevent the combination, which is a sign of how risky it is. The fix in the project is the right one: no wildcard by default, and a startup check. The KEV flag is false.
Quick check
Does upgrading fix my existing configuration?
Not necessarily. If your environment file sets a wildcard, change it to explicit origins.
Sources
Last reviewed: 19 October 2026.
