Unsigned Public Key Bundle Deserialization Enables Encryption Bypass

CVE-2026-74876 is a critical deserialization vulnerability in openssl_encrypt that allows attackers to inject malicious public keys into key bundles without cryptographic verification. The vulnerability exists in the PublicKeyBundle.from_dict() method, which reconstructs key objects from untrusted data—such as configuration files, API responses, or inter-service messages—without validating signatures. An attacker can exploit this by crafting a malicious dictionary that defines a public key bundle, then calling to_identity() to establish trust relationships based on unsigned data. This enables attackers to replace legitimate recipient public keys with their own, allowing them to intercept and decrypt encrypted secrets meant for other parties. Any application using openssl_encrypt versions before 1.4.0 that deserializes key bundles from external sources is affected, making this a systemic risk across infrastructure relying on this library for encrypted communication.

While this CVE lacks mapped MITRE ATT&CK techniques, Casky's extended reasoning capabilities would flag this attack pattern by detecting the absence of cryptographic verification in key management workflows. Practitioners using Casky would see findings related to "Insecure Deserialization" (CWE-347) alongside behavioral indicators of "Credential Access" and "Lateral Movement" tactics—specifically the suspicious instantiation of PublicKeyBundle objects without signature validation checks, followed by immediate calls to trust-establishing methods. The platform would highlight code patterns where from_dict() is called on untrusted input sources, drawing connections to potential data exfiltration scenarios. Casky's skill mapping would recommend immediate patching to 1.4.0+, code review of all deserialization points, and implementation of cryptographic verification checks before accepting any key bundle data in production systems.