CVE-2026-74872: Critical 9.8 RCE in openssl_encrypt via Malicious Whirlpool .so Loading — Detection and Remediation Guide

The National Vulnerability Database has published CVE-2026-74872, a CVSS 9.8 (Critical) vulnerability in openssl_encrypt, a widely deployed Python cryptography wrapper built on OpenSSL. The flaw lives in the Whirlpool hash implementation: on module load, the package uses overly broad glob patterns to discover and load native .so shared objects from site-packages without any integrity verification. Any attacker — local or remote through a co-resident write primitive — who can place a file matching the pattern whirlpool*py313*.so into a site-packages directory achieves arbitrary native code execution the moment the module is imported.

This is the 2026 textbook case of a search-path / module-loading hijack in the Python ecosystem. With the vulnerability marked network-exploitable in NVD's assessment, and openssl_encrypt present in countless server-side applications, containers, and CI/CD images, defenders need to treat this as a top-of-queue remediation. Every Python 3.13 environment running openssl_encrypt < 1.4.0 is a candidate target.

Technical Analysis

Affected Component and Versions

The py313 in the glob pattern indicates the loader targets CPython 3.13 ABI-tagged extensions, meaning Python 3.13 deployments are squarely in the blast radius, but any version string matching the loader's glob logic should be treated as suspect until confirmed otherwise.

How the Vulnerability Works (Defender's View)

1. Flawed discovery logic. When the Whirlpool functionality is initialized, openssl_encrypt globs site-packages for files matching whirlpool*py313*.so and dlopens the first match it finds.
2. No integrity verification. There is no signature check, no hash allowlist, no path pinning to the package's own installation directory. The loader will happily load any matching file.
3. Attacker primitive. An attacker who can write a file into any site-packages directory on the path — via a web application file-upload flaw, an exposed writable venv, a poisoned container layer, a malicious transitive dependency, or a compromised build pipeline — drops a crafted whirlpool_evilpy313.so.
4. Code execution on import. The next time the application (or a worker, cron job, or web process) imports the module and touches the Whirlpool code path, the malicious .so executes with the full privileges of the Python process — typically a service account with database, secret, and network access.

The NETWORK designation reflects that in many realistic deployments (web frameworks, task queues, API services), the file-write primitive and the module reload are remotely triggerable, and no user interaction is required.

Exploitation Status

At publication, this vulnerability is documented by NVD with a clear and trivial exploitation path. The attack requires only the ability to place a file with a predictable name in a predictable location — a bar so low that security teams should assume weaponization is imminent or already occurring in environments where Python services accept uploads, run multi-tenant workloads, or build containers from community base images. Check CISA KEV status as part of your triage; even absent a KEV listing, a 9.8 with a one-file exploit primitive warrants emergency change treatment.

Detection & Response

The highest-fidelity detection for this vulnerability is watching for unauthorized .so files landing in site-packages matching the glob pattern, and flagging non-package-manager processes writing to those directories. The rules below are tuned to minimize noise: legitimate writes to site-packages come almost exclusively from pip, pipx, poetry, uv, or the package manager of your distro — everything else is suspicious by default.

Sigma Rules

---
title: Suspicious Whirlpool Shared Object Planted in Python Site-Packages
id: 3f8c1a72-6b4d-4e91-a2c5-9d7e2f1b8a40
status: experimental
description: Detects creation of .so files matching the whirlpool*py313*.so glob pattern in Python site-packages directories, consistent with exploitation of CVE-2026-74872 (openssl_encrypt < 1.4.0 arbitrary code execution via unverified module loading).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74872
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.persistence
  - attack.t1574
  - attack.t1574.006
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - 'site-packages'
  selection_name:
    TargetFilename|contains:
      - 'whirlpool'
      - 'Whirlpool'
  selection_abi:
    TargetFilename|contains:
      - 'py313'
      - 'cpython-313'
  selection_ext:
    TargetFilename|endswith: '.so'
  condition: selection_path and selection_name and selection_abi and selection_ext
falsepositives:
  - Legitimate installation of openssl_encrypt or related Whirlpool bindings via pip; validate the file hash against the official package release
level: high
---
title: Non-Package-Manager Process Writing Shared Objects to Site-Packages
id: 7b2e4d91-1f8a-4c36-b5e2-4a9d6c0f3e71
status: experimental
description: Detects processes other than pip/poetry/uv or system package managers writing .so files into Python site-packages directories. A strong indicator of shared-object hijacking attempts such as CVE-2026-74872.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-74872
author: Security Arsenal
date: 2026/06/10
tags:
  - attack.defense_evasion
  - attack.t1574
  - attack.t1574.006
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - 'site-packages'
  selection_ext:
    TargetFilename|endswith: '.so'
  filter_legit:
    Image|endswith:
      - '/pip'
      - '/pip3'
      - '/pipx'
      - '/poetry'
      - '/uv'
      - '/python'
      - '/python3'
      - '/apt'
      - '/dpkg'
      - '/dnf'
      - '/rpm'
  condition: selection_path and selection_ext and not filter_legit
falsepositives:
  - Build systems (setuptools, cmake invoked directly) and container image builds; scope the rule to production runtime hosts or allowlist build pipelines
level: high

KQL — Microsoft Sentinel / Defender

For Linux estates forwarding Syslog/auditd or Defender for Endpoint telemetry, hunt for the planted file artifact directly:

// Hunt for whirlpool*py313*.so artifacts in site-packages (CVE-2026-74872)
let Lookback = 14d;
union withsource=TableName_ (DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has "site-packages"
| where FileName has "whirlpool" and FileName endswith ".so"
| where FileName has "py313" or FileName has "cpython-313"
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine),
(Syslog
| where TimeGenerated > ago(Lookback)
| where SyslogMessage has "site-packages" and SyslogMessage has "whirlpool" and SyslogMessage has ".so"
| project TimeGenerated, HostName, SyslogMessage, ProcessName)
| order by TimeGenerated desc

Velociraptor VQL

Sweep the fleet for the planted artifact and collect hashes for validation against the official package:

-- Hunt for rogue whirlpool*py313*.so files in Python site-packages (CVE-2026-74872)
SELECT FullPath,
       Size,
       Mtime,
       Ctime,
       hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs=[
  '**/site-packages/**/whirlpool*py313*.so',
  '**/site-packages/**/Whirlpool*py313*.so',
  '**/site-packages/**/whirlpool*cpython-313*.so'
], root='/')

Remediation / Verification Script (Bash)

Run this on every host, container image, and CI runner with Python 3.13 environments. It inventories openssl_encrypt versions, scans every site-packages tree for suspicious .so files matching the exploit glob, and upgrades the package:

#!/bin/bash
# CVE-2026-74872 verification and remediation - openssl_encrypt < 1.4.0
set -u

echo "=== [1] Locate Python 3.13 environments and openssl_encrypt versions ==="
found_vuln=0
while IFS= read -r pip_bin; do
    ver=$("$pip_bin" show openssl_encrypt 2>/dev/null | awk '/^Version:/ {print $2}')
    if [ -n "$ver" ]; then
        echo "[*] $pip_bin reports openssl_encrypt $ver"
        major=$(echo "$ver" | cut -d. -f1)
        minor=$(echo "$ver" | cut -d. -f2)
        if [ "$major" -lt 1 ] || { [ "$major" -eq 1 ] && [ "$minor" -lt 4 ]; }; then
            echo "[!] VULNERABLE VERSION DETECTED ($ver < 1.4.0) via $pip_bin"
            found_vuln=1
            echo "[+] Upgrading to >=1.4.0..."
            "$pip_bin" install --upgrade "openssl_encrypt>=1.4.0"
        fi
    fi
done < <(find / -type f \( -name "pip3" -o -name "pip" \) -path "*/bin/*" 2>/dev/null)

echo "=== [2] Scan all site-packages for whirlpool*py313*.so artifacts ==="
while IFS= read -r so_file; do
    echo "[!] Suspicious shared object found: $so_file"
    sha256sum "$so_file"
    # Verify hash against the official 1.4.0+ package release before trusting.
    # Quarantine if it does not match:
    #   mkdir -p /var/quarantine && mv "$so_file" /var/quarantine/
    found_vuln=1
done < <(find / -type d -name "site-packages" -exec find {} -maxdepth 3 -type f \( -iname "whirlpool*py313*.so" -o -iname "whirlpool*cpython-313*.so" \) \; 2>/dev/null)

echo "=== [3] Tighten site-packages permissions (defense-in-depth) ==="
find / -type d -name "site-packages" 2>/dev/null | while read -r sp; do
    # Nobody outside root should write here at runtime; adjust for your venv owner model
    chmod o-w "$sp" 2>/dev/null && echo "[+] Removed world-write: $sp"
done

if [ "$found_vuln" -eq 0 ]; then
    echo "[OK] No vulnerable openssl_encrypt versions or rogue .so artifacts detected."
fi

Remediation

1. Upgrade immediately. Patch openssl_encrypt to version 1.4.0 or later in every environment — application servers, containers, serverless layers, CI/CD images, and developer workstations. Run pip install --upgrade "openssl_encrypt>=1.4.0" and pin the floor version in requirements.txt / pyproject.toml (openssl_encrypt>=1.4.0) so vulnerable versions cannot regress through dependency resolution.
2. Rebuild container images. The fix does not propagate to already-built images. Rebuild and redeploy all images embedding Python 3.13 with this package, and invalidate cached build layers that may retain the old wheel.
3. Inventory and attest. Use the script and VQL artifact above to sweep for whirlpool*py313*.so files. Any .so whose SHA-256 does not match the official package build must be treated as a confirmed compromise — preserve it for forensic analysis and initiate your IR process, because its presence implies an attacker already had a write primitive in your environment.
4. Harden the write path (defense-in-depth). Runtime service accounts should never have write access to site-packages. Enforce read-only venvs for production services, mount Python environments read-only in containers (readOnlyRootFilesystem), and lock upload directories with noexec and strict type validation.
5. Control the supply chain. Audit transitive dependencies that could deliver a malicious .so as a payload. Enforce hash-pinning (pip install --require-hashes), use private package mirrors with allowlists, and scan wheels for unexpected native extensions before promotion.
6. Monitor for KEV inclusion. Track https://nvd.nist.gov/vuln/detail/CVE-2026-74872 and CISA's Known Exploited Vulnerabilities catalog. Given the trivial exploitation primitive, treat any KEV listing as a mandate for the associated federal remediation deadline — and as confirmation that unpatched hosts should be presumed targeted.

The broader lesson is one we've seen repeat across 2025 and into 2026: module loading without integrity verification is a code-execution vulnerability waiting for a delivery mechanism. Audit your estates for any Python (or Node, or Ruby) package that dynamically loads native code via glob or search-path logic — this will not be the last 9.8 of this class.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub