CVE-2026-81684— openssl_encrypt before 1.4.9 Information Disclosure via Command Line
Quick assessment
Affected
jahlives openssl_encrypt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 openssl-encrypt（pip 包 openssl-encrypt）版本 1.4.8 及更早版本中，桌面 GUI 在加密和解密流程中，均通过命令行参数 将隐写（steganography）密码传递给 CLI 子进程，而非像主密码那样通过环境变量传递。在该子进程运行期间，任何本地用户都可以通过读取 获取到隐写密码。该问题已在版本 1.4.9 中修复。
Possible ATT&CK Techniques 2 AI
T1082 · System Information Discovery T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
affected |
1.4.9 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81684
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
openssl_encrypt before 1.4.9 Information Disclosure via Command Line
Source: CVE Program / CVE List V5
Vulnerability Description
In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过处理环境导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jahlives | openssl_encrypt | 0 ~ 1.4.9 | - |
|
II. Public POCs for CVE-2026-81684
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81684
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81684 (2)
Same Patch Batch · jahlives · 2026-08-27 · 36 CVEs total
| CVE-2026-81707 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email |
| CVE-2026-81702 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Key Substitution via Identity Load |
| CVE-2026-81701 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin |
| CVE-2026-81700 | 9.8 CRITICAL | openssl_encrypt before 1.4.9 GPG Signature Verification Bypass |
| CVE-2026-81683 | 8.4 HIGH | openssl_encrypt before 1.4.9 Plaintext Private Key Storage |
| CVE-2026-81719 | 7.8 HIGH | openssl_encrypt before 1.4.9 Remote Code Execution via Plugin |
| CVE-2026-81688 | 7.5 HIGH | openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256 |
| CVE-2026-81692 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO |
| CVE-2026-81699 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost |
| CVE-2026-81689 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Pepper Key Derivation |
| CVE-2026-81705 | 7.5 HIGH | openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug |
| CVE-2026-81718 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Cryptographic Parameters |
| CVE-2026-81691 | 7.5 HIGH | openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs |
| CVE-2026-81693 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via QR total field |
| CVE-2026-81698 | 7.5 HIGH | openssl_encrypt before 1.4.9 Shell Injection via info command |
| CVE-2026-81721 | 7.5 HIGH | openssl_encrypt before 1.4.9 Denial of Service via KDF |
| CVE-2026-81704 | 7.5 HIGH | openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus |
| CVE-2026-81690 | 7.3 HIGH | verify-usb before 1.4.9 Symlink Directory Traversal Code Execution |
| CVE-2026-81714 | 7.0 HIGH | openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass |
| CVE-2026-81706 | 6.8 MEDIUM | openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: openssl_encrypt
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same vendor: jahlives
-
CVE-2026-81721
openssl_encrypt before 1.4.9 Denial of Service via KDF -
CVE-2026-81719
openssl_encrypt before 1.4.9 Remote Code Execution via Plugi -
CVE-2026-81720
openssl_encrypt before 1.4.9 Denial of Service via Unbounded -
CVE-2026-81718
openssl_encrypt before 1.4.9 Weak Cryptographic Parameters -
CVE-2026-81717
openssl_encrypt before 1.4.9 Integrity Bypass via Added File
Same weakness: CWE-214
-
CVE-2026-80158
Ansible-collection-community-general: community.general: ipa -
CVE-2026-65088
NVIDIA NemoClaw漏洞致敏感信息泄露 -
CVE-2026-76054
Black Duck blackduck-c-cpp 1.0.17-3.0.6 敏感信息泄露漏洞 -
CVE-2026-74873
openssl_encrypt before 1.4.0 Password Exposure via CLI Argum -
CVE-2026-18915
Exposure of OTP Secret Through Process Command-Line Argument
V. Comments for CVE-2026-81684
No comments yet