CVE-2026-81683— openssl_encrypt before 1.4.9 Plaintext Private Key Storage
Quick assessment
Affected
jahlives openssl_encrypt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： openssl_encrypt（PyPI 包名：openssl-encrypt） 在 1.4.8 及更早版本中，通过桌面端图形界面（GUI）的“设置”屏幕中“合并证书与私钥”PEM 字段，将 mTLS 客户端私钥以明文形式存储在权限为 0644（所有用户可读）的 SharedPreferences 文件中。拥有文件系统访问权限的本地攻击者可以读取该暴露的私钥。 1.4.9 版本将 PEM 内容写入一个专用且权限为 0600（仅所有者可读写）的文件，仅在 SharedPreference
Possible ATT&CK Techniques 3 AI
T1005 · Data from Local System T1212 · Exploitation for Credential Access T1082 · System Information DiscoveryAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
affected |
1.4.9 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81683
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
openssl_encrypt before 1.4.9 Plaintext Private Key Storage
Source: CVE Program / CVE List V5
Vulnerability Description
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jahlives | openssl_encrypt | 0 ~ 1.4.9 | - |
|
II. Public POCs for CVE-2026-81683
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81683
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81683 (2)
Same Patch Batch · jahlives · 2026-08-27 · 36 CVEs total
| CVE-2026-81707 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email |
| CVE-2026-81701 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin |
| CVE-2026-81700 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 GPG Signature Verification Bypass |
| CVE-2026-81702 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Key Substitution via Identity Load |
| CVE-2026-81719 | 7.8 HIGH | openssl_encrypt before 1.4.9 Remote Code Execution via Plugin |
| CVE-2026-81721 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via KDF |
| CVE-2026-81698 | 7.5 HIGH | openssl_encrypt before 1.4.9 Shell Injection via info command |
| CVE-2026-81704 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus |
| CVE-2026-81693 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via QR total field |
| CVE-2026-81691 | 7.5 HIGH | openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs |
| CVE-2026-81705 | 7.5 HIGH | openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug |
| CVE-2026-81689 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Pepper Key Derivation |
| CVE-2026-81699 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost |
| CVE-2026-81692 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO |
| CVE-2026-81688 | 7.5 HIGH | openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256 |
| CVE-2026-81718 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Cryptographic Parameters |
| CVE-2026-81690 | 7.3 HIGH | verify-usb before 1.4.9 Symlink Directory Traversal Code Execution |
| CVE-2026-81714 | 7.0 HIGH | openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass |
| CVE-2026-81706 | 6.8 MEDIUM | openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing |
| CVE-2026-81684 | 6.2 MEDIUM | openssl_encrypt before 1.4.9 Information Disclosure via Command Line |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: openssl_encrypt
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same vendor: jahlives
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same weakness: CWE-312
-
CVE-2026-59657
Apache CloudStack: Sensitive Information Disclosure via Clea -
CVE-2026-76405
Information Disclosure through Cleartext Storage in the App -
CVE-2026-76386
Information Disclosure through Action Parameters in Zoom app -
CVE-2026-76384
Information Disclosure through Action Parameters in Splunk A -
CVE-2026-76385
Information Disclosure through Action Parameters in Venafi a
V. Comments for CVE-2026-81683
No comments yet