Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81681— openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

Quick assessment

Affected
jahlives openssl_encrypt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

openssl_encrypt（PyPI 包 openssl-encrypt）版本 ≤ 1.4.8 将便携式 USB 工作区宣传为采用 AES-256-GCM 加密的“加密 USB 工作区”，并写入一个声明工作区已加密的标记文件，但实际上工作区目录是以明文形式存储的，且派生出的加密密钥从未实际应用于该目录。用户若轻信其品牌标识并将文件放入该工作区，这些文件将保持未加密状态留在可移动介质上，因此任何拥有该介质物理访问权的攻击者都能直接读取其中的敏感文件。该问题已在 1.4.9 版本中修复：此版本将工作区封装进一个经认

CVSS 4.6 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
jahlives openssl_encrypt < 1.4.9 affected
1.4.9 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81681

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
Source: CVE Program / CVE List V5
Vulnerability Description
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据加密缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jahlives openssl_encrypt 0 ~ 1.4.9 -

II. Public POCs for CVE-2026-81681

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81681

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-81681 (2)

Same Patch Batch · jahlives · 2026-08-27 · 36 CVEs total

CVE-2026-81707 9.8 CRITICAL openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email
CVE-2026-81702 9.8 CRITICAL openssl_encrypt before 1.4.9 Key Substitution via Identity Load
CVE-2026-81701 9.8 CRITICAL openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin
CVE-2026-81700 9.8 CRITICAL openssl_encrypt before 1.4.9 GPG Signature Verification Bypass
CVE-2026-81683 8.4 HIGH openssl_encrypt before 1.4.9 Plaintext Private Key Storage
CVE-2026-81719 7.8 HIGH openssl_encrypt before 1.4.9 Remote Code Execution via Plugin
CVE-2026-81688 7.5 HIGH openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256
CVE-2026-81692 7.5 HIGH openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO
CVE-2026-81699 7.5 HIGH openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost
CVE-2026-81689 7.5 HIGH openssl_encrypt before 1.4.9 Weak Pepper Key Derivation
CVE-2026-81705 7.5 HIGH openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug
CVE-2026-81718 7.5 HIGH openssl_encrypt before 1.4.9 Weak Cryptographic Parameters
CVE-2026-81691 7.5 HIGH openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs
CVE-2026-81693 7.5 HIGH openssl_encrypt before 1.4.9 Denial of Service via QR total field
CVE-2026-81698 7.5 HIGH openssl_encrypt before 1.4.9 Shell Injection via info command
CVE-2026-81704 7.5 HIGH openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus
CVE-2026-81721 7.5 HIGH openssl_encrypt before 1.4.9 Denial of Service via KDF
CVE-2026-81690 7.3 HIGH verify-usb before 1.4.9 Symlink Directory Traversal Code Execution
CVE-2026-81714 7.0 HIGH openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass
CVE-2026-81706 6.8 MEDIUM openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing

Showing top 20 of 36 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: openssl_encrypt
Same vendor: jahlives
Same weakness: CWE-311

V. Comments for CVE-2026-81681

No comments yet

Leave a comment