🚨 CVE-2026-81681
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.
🎖@cveNotify
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.
🎖@cveNotify
GitHub
Portable USB workspace advertised AES-256-GCM encryption while storing files in cleartext
The portable-USB creator's workspace was branded as an 'Encrypted USB Workspace' with '✅ AES-256-GCM encryption', wrote a marker declaring encrypted:true, and advertised auto_en...
🚨 CVE-2026-81682
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
🎖@cveNotify
GitHub
Desktop GUI writes decrypted plaintext with world-readable default permissions
The desktop GUI wrote decrypted output through file_manager's writeFileText/writeFileBytes, which use Dart's writeAsString/writeAsBytes and create the file at the process umask -- typically...
🚨 CVE-2026-81683
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.
🎖@cveNotify
openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.
🎖@cveNotify
GitHub
Desktop GUI stores an mTLS client private key in plaintext, world-readable SharedPreferences
The desktop GUI's Settings screen offered a 'combined certificate and private key' PEM paste field for the pepper and integrity mTLS clients, and stored the pasted value -- including th...
🚨 CVE-2026-81684
In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.
🎖@cveNotify
In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.
🎖@cveNotify
GitHub
Desktop GUI passes the steganography password on the child process command line, exposing it to other local users
The desktop GUI passed the steganography password to the CLI on the child process command line (--stego-password), on both the encrypt and decrypt paths, while the main password correctly used the ...
🚨 CVE-2026-81685
openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.
🎖@cveNotify
GitHub
Desktop GUI renders unauthenticated recovery-slot metadata unescaped, forging lines in the irreversible-removal dialog
The desktop GUI's recovery-slot management screen rendered the slot id and type from a file's list-recovery --json output with bare Text() widgets. That CLI JSON channel is deliberately uns...
🚨 CVE-2026-81686
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.
🎖@cveNotify
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.
🎖@cveNotify
GitHub
D-Bus Properties.Set lacks caller authorization and value validation, letting any local user DoS the crypto service
The optional D-Bus crypto service (1.4.x only; removed on the 1.5.x line) authorizes every functional method through polkit via _authorize_caller, but the org.freedesktop.DBus.Properties Set method...
🚨 CVE-2026-81687
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
🎖@cveNotify
GitHub
Decrypt gates KDF memory but not time, so crafted iteration counts wedge the CPU before authentication
The decrypt path estimates key-derivation cost from attacker-controlled file metadata and refuses to proceed above an 8 GiB memory ceiling (gitlab#128), but it never enforces a ceiling on estimated...
🚨 CVE-2026-81688
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.
🎖@cveNotify
GitHub
Unkeyed SHA-256 of the plaintext stored in the cleartext file header is a plaintext-confirmation oracle
Every encrypted file stored hashes.original_hash = SHA-256(plaintext) in its cleartext metadata header. Because the hash is unkeyed and readable without the password, anyone holding the file can co...
🚨 CVE-2026-81689
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
🎖@cveNotify
GitHub
Remote pepper wrap key derived as unsalted HKDF(password) enabling fleet-wide offline password guessing
The remote-pepper feature wraps the server-stored pepper under an AES-GCM key derived as HKDF-SHA256(ikm=password, salt=None, info='openssl_encrypt-pepper-key') for format_version >= 12,...
🚨 CVE-2026-81690
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on the hash side binds only the final path component. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which CPython loads in preference to recompiling the clean .py). The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).
🎖@cveNotify
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on the hash side binds only the final path component. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which CPython loads in preference to recompiling the clean .py). The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).
🎖@cveNotify
GitHub
verify-usb silently skips content under a planted directory symlink, allowing a forged PASSED
The verify-usb v2 added-file allowlist scan enumerated the drive with rglob('*'), which in CPython never descends into a symlinked directory and treats the symlink itself as an ordinary dir...
🚨 CVE-2026-81691
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
🎖@cveNotify
GitHub
keyserver login/register_with_email accept http:// and unconfigured server URLs, leaking credentials
The keyserver plugin's register() enforced https:// but login() and register_with_email() did not, and certificate pinning is only mounted for the https prefix. Setup instructions naming an htt...
🚨 CVE-2026-81692
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
🎖@cveNotify
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
🎖@cveNotify
GitHub
FLAC total_samples drives a multi-gigabyte allocation
The 36-bit STREAMINFO total_samples field was fed into np.random.randint(size=(total_samples, channels)); the only guard re-estimated when total_samples exceeded 100,000,000, so a ~50-byte fLaC fil...
🚨 CVE-2026-81693
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
🎖@cveNotify
GitHub
QR total field drives unbounded set/range materialization
_parse_multi_qr_data took the `total` field verbatim from an untrusted QR JSON payload and drove set(range(1, total+1)); two QR images declaring total=10**12 made keystore-cli import-qr allocate ~1...
🚨 CVE-2026-81694
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
🎖@cveNotify
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
🎖@cveNotify
GitHub
verify-usb prints attacker-planted filenames unsanitized, allowing a forged PASSED verdict
The verify-usb command builds its tampered/missing/added file lists from raw path names discovered by scanning the untrusted drive (data outside the AES-GCM authenticated manifest) and printed them...
🚨 CVE-2026-81695
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.
🎖@cveNotify
GitHub
Attacker-controlled key_id printed unescaped during decrypt auto-detection (terminal injection)
detect_encryption_type parsed an encrypted file's header with a bare json.loads and returned each asymmetric.recipients[].key_id; on the 'no matching identity' decrypt path these were p...
🚨 CVE-2026-81696
openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
🎖@cveNotify
GitHub
'info' prints untrusted file metadata without escaping terminal control characters
print_file_info (the `info` command) printed metadata fields -- algorithm, encryption_data, cipher_chain, layer_info[].cipher, hkdf_hash, salt, original_hash/encrypted_hash, pqc.public_key, hsm_plu...
🚨 CVE-2026-81698
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
🎖@cveNotify
GitHub
'info' reconstructed-CLI block interpolates untrusted metadata unquoted (shell injection when pasted)
The `info` command prints a 'Reconstructed CLI' block built by _reconstruct_cli_from_metadata, interpolating attacker-controlled metadata fields (pepper_name, hsm_plugin, algorithm, cipher_...
🚨 CVE-2026-81699
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
🎖@cveNotify
GitHub
Pre-authentication memory/CPU exhaustion via unbounded KDF cost in crafted files
Several code paths let a crafted file drive unbounded key-derivation cost past the pre-authentication memory ceiling (gitlab#128), OOM-killing or wedging the process before any password is verified...
🚨 CVE-2026-81700
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
🎖@cveNotify
GitHub
GPG detached-signature verification accepts revoked and expired keys
gpg_runner.verify_detached -- the single primitive behind plugin signatures (ENFORCE by default), the per-package PLUGIN.manifest, and the source-integrity manifest -- decided a signature was good ...
🚨 CVE-2026-81701
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
🎖@cveNotify
GitHub
Built-in plugin trust shortcut covers top-level plugins/ and unknown dirs, executing unsigned plugins
_is_builtin_plugin used a denylist: it treated every file under the package plugins/ directory as a trusted built-in (skipping signature verification, the AST scan and the TOCTOU hash pin) EXCEPT t...
🚨 CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
🎖@cveNotify
GitHub
Identity.load trusts the stored fingerprint without re-deriving it, enabling silent key substitution
Identity.load reads the `fingerprint` field verbatim from an identity's `identity.json` and never re-derives it from the actual public-key `.pem` files, unlike the import path (import_public), ...