← Vulnerability feed

Vulnerability record · CVE-2026-81681 · published 27 August 2026

CVE-2026-81681: Jahlives openssl encrypt missing encryption vulnerability

JJahlives · Openssl Encrypt

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.

9.3 CVSS 4.0 Critical EPSS 0.17% · top 94.1% CWE-311 · Missing encryption
9.3CVSS 4.0 base score
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
2 Sep 2026Last modified by NVD

Description

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2jv6-qqfm-m46m Vendor Advisory
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-false-encryption-via-cleartext-storage Third Party Advisory

Track CVE-2026-81681 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-81717Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the r…EPSS 0.12%9.3CVE-2026-81719Jahlives openssl encrypt code injection vulnerabilityopenssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an …EPSS 0.44%9.3CVE-2026-81706Jahlives openssl encrypt insufficient verification of data authenticity vulnerabilityopenssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create…EPSS 0.18%9.3CVE-2026-81714Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing t…EPSS 0.20%9.3CVE-2026-81698Jahlives openssl encrypt os command injection vulnerabilityopenssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrust…EPSS 0.43%9.3CVE-2026-81700Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired k…EPSS 0.35%9.3CVE-2026-81701Jahlives openssl encrypt improper verification of cryptographic signature vulnerabilityopenssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directorie…EPSS 0.43%9.3CVE-2026-81702Jahlives openssl encrypt insufficient verification of data authenticity vulnerabilityopenssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitut…EPSS 0.19%

Source: NIST National Vulnerability Database (record CVE-2026-81681), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.