Is CVE-2026-74899 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-74899?

CVE-2026-74899 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-74899

Description

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.