Root cause
Authentication & access control introduced
The settings file written for the new keyserver defaulted the database URL to a fixed PostgreSQL user name and password, so a deployment that set no environment variable connected with them.
A coding assistant co-authored the commit that added the post-quantum keyserver, and the settings file it wrote shipped a fixed PostgreSQL user name and password as the default database URL.
How AI contributed: Direct introductionPublished Feb 10, 2026 in 
jahlives/openssl_encryptAll 20 findings in this repository
Show full advisory descriptionHide advisory description
The change adds a standalone keyserver and reads its configuration from environment variables. The settings class declares DATABASE_URL with a default of postgresql://keyserver:keyserver@localhost/keyserver, and the database module creates the engine from that setting as soon as the application is imported, so a server started without the variable comes up on the fixed credential pair instead of failing. Because the same user name and password sit in the source, anyone who can reach the PostgreSQL port can present them and reach the keyserver database, and a deployment that never sets the variable keeps serving on that account. The fix removes the fallback and adds a startup check that refuses to run without a database URL.
What actually happenedHide details
The settings class added by this change reads DATABASE_URL from the environment but falls back to postgresql://keyserver:keyserver@localhost/keyserver. The keyserver builds its database engine from that value at import time, so a deployment that starts without the environment variable connects to PostgreSQL as keyserver with the password keyserver, a pair written in the repository for anyone to read. That connection is the keyserver's own database account, and nothing in the startup path requires the operator to replace the pair.
Fix
Security fix
The fixed credential default is removed and a startup check now rejects an empty database URL, so the server refuses to run until a real one is provided.
Case facts
- CVE ID
- CVE-2026-74891
- GHSA ID
- GHSA-V4VM-4XF2-FHQJ
- Published
- Feb 10, 2026
- Severity
- Not scored
- Language
- Python
- AI tool
Claude- AI role
- Direct introduction
- Vulnerable release
- < 1.4.0
- Fixed release
- v1.4.0
AI-assisted change
AI-assisted changeserver/key-server/app/config.pysource jahlives/openssl_encrypt@fafdfeed1b+18−0
@@ -0,0 +19,18 @@+class Settings(BaseSettings):+ """+ Server settings with environment variable support.+Show 14 hidden lines
+ All settings can be overridden via environment variables.+ Example: DATABASE_URL, API_TOKEN_SALT, etc.+ """++ # Application+ app_name: str = "OpenSSL Encrypt Keyserver"+ version: str = "1.0.0"+ debug: bool = False++ # Database+ database_url: str = os.getenv(+ "DATABASE_URL", "postgresql://keyserver:keyserver@localhost/keyserver"+ )+the new settings class declares the database URL with a default of the fixed keyserver PostgreSQL user name and password.
Security fix
Fixserver/key-server/app/config.pysource jahlives/openssl_encrypt@57e618d32e+25−4
@@ -29,10 +30,8 @@ class Settings(BaseSettings): version: str = "1.0.0" debug: bool = False - # Database- database_url: str = os.getenv(- "DATABASE_URL", "postgresql://keyserver:keyserver@localhost/keyserver"- )Show 31 hidden lines
+ # Database - MUST be set via environment variable+ database_url: str = os.getenv("DATABASE_URL", "") # Security api_token_salt: str = os.getenv("API_TOKEN_SALT", "change-me-in-production")@@ -55,2 +54,25 @@ class Settings(BaseSettings):+def validate_settings(s: Settings) -> None:+ """Validate critical settings at startup.++ Raises:+ ValueError: If required settings are missing or insecure.+ """+ if not s.database_url:+ if s.debug:+ logger.warning(+ "SECURITY WARNING: DATABASE_URL not set. "+ "Using in-memory SQLite for debug mode only."+ )+ s.database_url = "sqlite:///./debug_keyserver.db"+ else:+ raise ValueError(+ "DATABASE_URL environment variable is required. "+ "Example: DATABASE_URL=postgresql://user:pass@host/dbname"+ )+++logger = logging.getLogger(__name__)+ # Global settings instance settings = Settings()+validate_settings(settings)The fix deletes the hardcoded default and adds a startup check that refuses to run without a database URL.
Patch fingerprints
AI-assisted change 6508134ebd21546f8b9fb55b30057ce21ded49842efe544adbe17f793dc894a5 · Fix 13841df1eb833b2d27caae958fd7c59b6683c085f6648a8ae66adb4440773236