CVE-2026-74882 is a high severity (CVSS 7.5) insecure default in the openssl_encrypt Python package before 1.4.0. The server trusts the entire private address space as proxies, so a host on a private network could forge client certificate headers. Upgrade to 1.4.0 and trust only localhost.
What's affected
The pip package openssl_encrypt, versions before 1.4.0, per the record. The GitHub advisory lists the patched version as none, but also says the fix is commit 7462ad0 on the releases/1.4.x branch. Confirm the release you install includes that commit.
The setting is trusted_proxies in IntegrityProxyConfig, which defaulted to localhost plus 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The advisory notes that validation rejects networks smaller than a /24 prefix, so the exposure depends on that validation being relaxed or changed.
How to check if you're exposed
Check the version.
pip show openssl_encrypt
Then look at your configuration for trusted_proxies and see what you have. If the server sits behind a reverse proxy, the list should contain only that proxy's address. If it is not behind one, it should contain only localhost.
What to do now
- Upgrade openssl_encrypt to a release that includes the 1.4.x fix.
- Set trusted_proxies to the exact addresses of your reverse proxies, or localhost only.
- Do not allow clients on private networks to reach the server directly if it relies on proxy supplied client certificate headers.
- Review who can reach the server from internal networks.
- Check logs for requests from private addresses that carried client certificate headers.
Why it matters
The record maps this to CWE-345, insufficient verification of data authenticity. When an application sits behind a proxy that terminates mutual TLS, it reads the client certificate details from headers the proxy adds. That is safe only if the application accepts those headers from the proxy alone. If any machine in a large range counts as a proxy, any machine in that range can write the headers.
Broad trust ranges are easy to ship as defaults because they make setups work out of the box. The advisory's fix is to default to localhost and require explicit configuration for anything wider. The KEV flag is false.
Quick check
Is the flaw exploitable as shipped?
The advisory says it matters if the proxy validation is relaxed or bypassed. Treat the broad default as a risk anyway.
Sources
Last reviewed: 19 October 2026.
