OpenSSL Encrypt: 25 Vulnerabilities Including Critical Key Flaws Disclosed Together
OpenSSL Encrypt product faces a critical disclosure of 25 vulnerabilities, including key substitution and private key exposure, patched in v1.4.9.
Key findings
- Critical CVE-2026-81702 allows public key substitution due to improper fingerprint validation.
- High CVE-2026-81683 exposes mTLS client private keys in world-readable files.
- Low CVE-2026-81715 leaks keyserver bearer tokens in debug output.
- Medium CVE-2026-81684 passes steganography passwords via insecure command-line arguments.
- All 25 disclosed vulnerabilities are fixed in OpenSSL Encrypt version 1.4.9.
On August 27, 2026, a significant batch of 25 vulnerabilities was disclosed for Jahlives' Openssl Encrypt product, all detailed within a single advisory. These vulnerabilities, spanning critical to low severity, primarily revolve around insecure handling of sensitive data, key management, and configuration flaws. The disclosures highlight potential risks including unauthorized access to private keys, exposure of sensitive tokens, and susceptibility to man-in-the-middle attacks.
Several vulnerabilities center on the improper handling of cryptographic keys and tokens. CVE-2026-81702, a critical flaw with a CVSS score of 9.8, allows attackers to substitute public keys in identity stores by failing to re-derive and validate fingerprints when loading identities from identity.json. This enables silent key substitution, undermining trust in encrypted communications.
Another high-severity vulnerability, CVE-2026-81683 (CVSSv3 8.4), involves the storage of an mTLS client private key in a world-readable file. The desktop GUI's Settings screen exposes this key through a "combined certificate and private key" PEM field, allowing local attackers with file system access to retrieve the exposed private key.
Further issues relate to insecure data exposure and configuration weaknesses. CVE-2026-81715 (CVSSv3 3.3) details how openssl_encrypt versions up to 1.4.8 fail to redact keyserver bearer tokens passed as positional arguments to keyserver set-token in debug output, printing them in cleartext. Additionally, CVE-2026-81684 (CVSSv3 6.2) points out that the desktop GUI passes the steganography password to a child process via the command line, rather than a more secure environment variable, making it accessible to local users. A CWD-relative configuration file resolution flaw in crypt_settings.py (CVE-2026-81697, CVSSv3 5.5) also presents a security risk, where the configuration file path could be manipulated.
All disclosed issues, including the five detailed here, have been resolved in Openssl Encrypt version 1.4.9. Users are strongly advised to update to the latest version to mitigate these risks. The batch of vulnerabilities underscores the importance of secure key management and robust input sanitization in cryptographic software.
The timely disclosure and patching of these vulnerabilities by the OpenSSL Project team demonstrate a commitment to product security. Users of Openssl Encrypt should prioritize updating their installations to version 1.4.9 to protect against potential exploitation of these flaws. Continued vigilance in reviewing security advisories and applying updates promptly is crucial for maintaining a secure environment.