Description

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T11:16:42.863Z",
  "pubdate": "2026-08-17T11:16:42.863Z",
  "executiveSummary": "openssl_encrypt versions prior to 1.4.0 suffer from an insecure default configuration vulnerability involving trusted_proxies within the IntegrityProxyConfig component.\nThe flaw allows attackers situated on private networks to forge client certificate headers, successfully bypassing mutual TLS (mTLS) authentication mechanisms when ProxyAuth validation is relaxed or modified.\nThe impact includes unauthorized access to protected resources and services relying on the compromised mTLS authentication boundary.\nAffected systems are those running openssl_encrypt before version 1.4.0 with default or unmodified IntegrityProxyConfig settings.\nAttacker capabilities require network access within the RFC 1918 private address space to exploit the default trust configuration and manipulate certificate headers.\nRisk implications are high for environments improperly hardening proxy authentication or operating within trusted internal network topologies without strict validation.",
  "technicalDetails": "The vulnerability stems from an insecure default configuration in openssl_encrypt prior to version 1.4.0, specifically residing within the IntegrityProxyConfig trusted_proxies component.\nThe root cause is the automatic and overly permissive trust assigned to the entire RFC 1918 private address space by default.\nWhen ProxyAuth validation is relaxed, modified, or improperly enforced, this broad trust scope introduces a severe security gap in identity verification.\nThe vulnerable component is the IntegrityProxyConfig handling of trusted_proxies in affected versions of openssl_encrypt.\nAttackers located on private networks leverage this misconfiguration by sending crafted requests through the network.\nBecause the proxy configuration implicitly trusts the entire RFC 1918 address space, the system accepts forged client certificate headers originating from these internal ranges without sufficient cryptographic verification.\nThe attack flow proceeds as follows: an attacker positioned on an RFC 1918 private network crafts an HTTP or protocol-specific request containing forged client certificate headers.\nThe proxy processes the request, and due to the overly broad trusted_proxies setting, erroneously treats the source within the private address space as a trusted intermediary.\nThe application subsequently trusts the forged headers, bypassing the required mTLS authentication checks.\nThis leads directly to unauthorized authentication bypass and potential access to restricted backend services or data.\nNetwork exposure is restricted to internal actors or compromised entities residing within the private RFC 1918 address space.\nNo special privileges are initially required beyond network positioning within the private IP range, assuming ProxyAuth validation is relaxed or altered."
}