🚨 CVE-2026-81686
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.
🎖@cveNotify
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.
🎖@cveNotify
GitHub
D-Bus Properties.Set lacks caller authorization and value validation, letting any local user DoS the crypto service
The optional D-Bus crypto service (1.4.x only; removed on the 1.5.x line) authorizes every functional method through polkit via _authorize_caller, but the org.freedesktop.DBus.Properties Set method...
🚨 CVE-2026-81687
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.
🎖@cveNotify
GitHub
Decrypt gates KDF memory but not time, so crafted iteration counts wedge the CPU before authentication
The decrypt path estimates key-derivation cost from attacker-controlled file metadata and refuses to proceed above an 8 GiB memory ceiling (gitlab#128), but it never enforces a ceiling on estimated...
🚨 CVE-2026-81688
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.
🎖@cveNotify
GitHub
Unkeyed SHA-256 of the plaintext stored in the cleartext file header is a plaintext-confirmation oracle
Every encrypted file stored hashes.original_hash = SHA-256(plaintext) in its cleartext metadata header. Because the hash is unkeyed and readable without the password, anyone holding the file can co...
🚨 CVE-2026-81689
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
🎖@cveNotify
GitHub
Remote pepper wrap key derived as unsalted HKDF(password) enabling fleet-wide offline password guessing
The remote-pepper feature wraps the server-stored pepper under an AES-GCM key derived as HKDF-SHA256(ikm=password, salt=None, info='openssl_encrypt-pepper-key') for format_version >= 12,...
🚨 CVE-2026-81690
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on the hash side binds only the final path component. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which CPython loads in preference to recompiling the clean .py). The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).
🎖@cveNotify
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on the hash side binds only the final path component. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which CPython loads in preference to recompiling the clean .py). The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).
🎖@cveNotify
GitHub
verify-usb silently skips content under a planted directory symlink, allowing a forged PASSED
The verify-usb v2 added-file allowlist scan enumerated the drive with rglob('*'), which in CPython never descends into a symlinked directory and treats the symlink itself as an ordinary dir...
🚨 CVE-2026-81691
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
🎖@cveNotify
GitHub
keyserver login/register_with_email accept http:// and unconfigured server URLs, leaking credentials
The keyserver plugin's register() enforced https:// but login() and register_with_email() did not, and certificate pinning is only mounted for the https prefix. Setup instructions naming an htt...
🚨 CVE-2026-81692
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
🎖@cveNotify
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
🎖@cveNotify
GitHub
FLAC total_samples drives a multi-gigabyte allocation
The 36-bit STREAMINFO total_samples field was fed into np.random.randint(size=(total_samples, channels)); the only guard re-estimated when total_samples exceeded 100,000,000, so a ~50-byte fLaC fil...
🚨 CVE-2026-81693
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
🎖@cveNotify
GitHub
QR total field drives unbounded set/range materialization
_parse_multi_qr_data took the `total` field verbatim from an untrusted QR JSON payload and drove set(range(1, total+1)); two QR images declaring total=10**12 made keystore-cli import-qr allocate ~1...
🚨 CVE-2026-81694
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
🎖@cveNotify
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
🎖@cveNotify
GitHub
verify-usb prints attacker-planted filenames unsanitized, allowing a forged PASSED verdict
The verify-usb command builds its tampered/missing/added file lists from raw path names discovered by scanning the untrusted drive (data outside the AES-GCM authenticated manifest) and printed them...
🚨 CVE-2026-81695
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.
🎖@cveNotify
GitHub
Attacker-controlled key_id printed unescaped during decrypt auto-detection (terminal injection)
detect_encryption_type parsed an encrypted file's header with a bare json.loads and returned each asymmetric.recipients[].key_id; on the 'no matching identity' decrypt path these were p...
🚨 CVE-2026-81696
openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
🎖@cveNotify
GitHub
'info' prints untrusted file metadata without escaping terminal control characters
print_file_info (the `info` command) printed metadata fields -- algorithm, encryption_data, cipher_chain, layer_info[].cipher, hkdf_hash, salt, original_hash/encrypted_hash, pqc.public_key, hsm_plu...
🚨 CVE-2026-81698
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
🎖@cveNotify
GitHub
'info' reconstructed-CLI block interpolates untrusted metadata unquoted (shell injection when pasted)
The `info` command prints a 'Reconstructed CLI' block built by _reconstruct_cli_from_metadata, interpolating attacker-controlled metadata fields (pepper_name, hsm_plugin, algorithm, cipher_...
🚨 CVE-2026-81699
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
🎖@cveNotify
GitHub
Pre-authentication memory/CPU exhaustion via unbounded KDF cost in crafted files
Several code paths let a crafted file drive unbounded key-derivation cost past the pre-authentication memory ceiling (gitlab#128), OOM-killing or wedging the process before any password is verified...
🚨 CVE-2026-81700
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
🎖@cveNotify
GitHub
GPG detached-signature verification accepts revoked and expired keys
gpg_runner.verify_detached -- the single primitive behind plugin signatures (ENFORCE by default), the per-package PLUGIN.manifest, and the source-integrity manifest -- decided a signature was good ...
🚨 CVE-2026-81701
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
🎖@cveNotify
GitHub
Built-in plugin trust shortcut covers top-level plugins/ and unknown dirs, executing unsigned plugins
_is_builtin_plugin used a denylist: it treated every file under the package plugins/ directory as a trusted built-in (skipping signature verification, the AST scan and the TOCTOU hash pin) EXCEPT t...
🚨 CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
🎖@cveNotify
GitHub
Identity.load trusts the stored fingerprint without re-deriving it, enabling silent key substitution
Identity.load reads the `fingerprint` field verbatim from an identity's `identity.json` and never re-derives it from the actual public-key `.pem` files, unlike the import path (import_public), ...
🚨 CVE-2026-81703
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.
🎖@cveNotify
GitHub
Crafted file with an unencrypted embedded post-quantum private key decrypts under any password
decrypt_file adopts a post-quantum private key embedded in a file's own metadata (encryption.pqc_private_key) verbatim whenever pqc_key_encrypted is false or absent (it defaults to False). For ...
🚨 CVE-2026-81704
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
🎖@cveNotify
GitHub
D-Bus EncryptFile derived keys without password stretching (unstretched SHA-256)
The D-Bus CryptoService.EncryptFile handler hand-built its hash_config using flat key names (sha512_iterations, argon2_time_cost/argon2_memory_cost/argon2_parallelism, enable_hkdf, balloon_iteratio...
🚨 CVE-2026-81705
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
🎖@cveNotify
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
🎖@cveNotify
GitHub
File password printed in cleartext by the --debug argv dump for bundled and abbreviated option spellings
Under `--debug`, openssl-encrypt prints its own argv, routing secret-valued options through a redaction chokepoint first. `sanitize_argv_for_debug` selected what to redact by **exact string members...
🚨 CVE-2026-81706
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.
🎖@cveNotify
GitHub
Contact stored under an own identity's name silently substitutes its keys when the identity is deleted
### Summary
`IdentityStore.get_by_name` resolves `base_path/<name>` (own identities) before `contacts/<name>`, but `add_identity` chose the destination directory purely from `is_own_id...
`IdentityStore.get_by_name` resolves `base_path/<name>` (own identities) before `contacts/<name>`, but `add_identity` chose the destination directory purely from `is_own_id...
🚨 CVE-2026-81707
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.
🎖@cveNotify
GitHub
Imported identity email printed unsanitized lets ANSI escapes forge the fingerprint verification line
### Summary
`Identity.import_public` validated the identity `name` but accepted the `email` field of an imported identity document completely raw, and the CLI printed it to the terminal unsanitize...
`Identity.import_public` validated the identity `name` but accepted the `email` field of an imported identity document completely raw, and the CLI printed it to the terminal unsanitize...