🚨 CVE-2026-81690
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on the hash side binds only the final path component. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which CPython loads in preference to recompiling the clean .py). The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).
🎖@cveNotify
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on the hash side binds only the final path component. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which CPython loads in preference to recompiling the clean .py). The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).
🎖@cveNotify
GitHub
verify-usb silently skips content under a planted directory symlink, allowing a forged PASSED
The verify-usb v2 added-file allowlist scan enumerated the drive with rglob('*'), which in CPython never descends into a symlinked directory and treats the symlink itself as an ordinary dir...
🚨 CVE-2026-81691
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.
🎖@cveNotify
GitHub
keyserver login/register_with_email accept http:// and unconfigured server URLs, leaking credentials
The keyserver plugin's register() enforced https:// but login() and register_with_email() did not, and certificate pinning is only mounted for the https prefix. Setup instructions naming an htt...
🚨 CVE-2026-81692
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
🎖@cveNotify
openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.
🎖@cveNotify
GitHub
FLAC total_samples drives a multi-gigabyte allocation
The 36-bit STREAMINFO total_samples field was fed into np.random.randint(size=(total_samples, channels)); the only guard re-estimated when total_samples exceeded 100,000,000, so a ~50-byte fLaC fil...
🚨 CVE-2026-81693
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.
🎖@cveNotify
GitHub
QR total field drives unbounded set/range materialization
_parse_multi_qr_data took the `total` field verbatim from an untrusted QR JSON payload and drove set(range(1, total+1)); two QR images declaring total=10**12 made keystore-cli import-qr allocate ~1...
🚨 CVE-2026-81694
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
🎖@cveNotify
openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().
🎖@cveNotify
GitHub
verify-usb prints attacker-planted filenames unsanitized, allowing a forged PASSED verdict
The verify-usb command builds its tampered/missing/added file lists from raw path names discovered by scanning the untrusted drive (data outside the AES-GCM authenticated manifest) and printed them...
🚨 CVE-2026-81695
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.
🎖@cveNotify
GitHub
Attacker-controlled key_id printed unescaped during decrypt auto-detection (terminal injection)
detect_encryption_type parsed an encrypted file's header with a bare json.loads and returned each asymmetric.recipients[].key_id; on the 'no matching identity' decrypt path these were p...
🚨 CVE-2026-81696
openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.
🎖@cveNotify
GitHub
'info' prints untrusted file metadata without escaping terminal control characters
print_file_info (the `info` command) printed metadata fields -- algorithm, encryption_data, cipher_chain, layer_info[].cipher, hkdf_hash, salt, original_hash/encrypted_hash, pqc.public_key, hsm_plu...
🚨 CVE-2026-81698
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
🎖@cveNotify
GitHub
'info' reconstructed-CLI block interpolates untrusted metadata unquoted (shell injection when pasted)
The `info` command prints a 'Reconstructed CLI' block built by _reconstruct_cli_from_metadata, interpolating attacker-controlled metadata fields (pepper_name, hsm_plugin, algorithm, cipher_...
🚨 CVE-2026-81699
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
🎖@cveNotify
GitHub
Pre-authentication memory/CPU exhaustion via unbounded KDF cost in crafted files
Several code paths let a crafted file drive unbounded key-derivation cost past the pre-authentication memory ceiling (gitlab#128), OOM-killing or wedging the process before any password is verified...
🚨 CVE-2026-81700
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
🎖@cveNotify
GitHub
GPG detached-signature verification accepts revoked and expired keys
gpg_runner.verify_detached -- the single primitive behind plugin signatures (ENFORCE by default), the per-package PLUGIN.manifest, and the source-integrity manifest -- decided a signature was good ...
🚨 CVE-2026-81701
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
🎖@cveNotify
GitHub
Built-in plugin trust shortcut covers top-level plugins/ and unknown dirs, executing unsigned plugins
_is_builtin_plugin used a denylist: it treated every file under the package plugins/ directory as a trusted built-in (skipping signature verification, the AST scan and the TOCTOU hash pin) EXCEPT t...
🚨 CVE-2026-81702
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
🎖@cveNotify
GitHub
Identity.load trusts the stored fingerprint without re-deriving it, enabling silent key substitution
Identity.load reads the `fingerprint` field verbatim from an identity's `identity.json` and never re-derives it from the actual public-key `.pem` files, unlike the import path (import_public), ...
🚨 CVE-2026-81703
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.
🎖@cveNotify
GitHub
Crafted file with an unencrypted embedded post-quantum private key decrypts under any password
decrypt_file adopts a post-quantum private key embedded in a file's own metadata (encryption.pqc_private_key) verbatim whenever pqc_key_encrypted is false or absent (it defaults to False). For ...
🚨 CVE-2026-81704
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
🎖@cveNotify
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
🎖@cveNotify
GitHub
D-Bus EncryptFile derived keys without password stretching (unstretched SHA-256)
The D-Bus CryptoService.EncryptFile handler hand-built its hash_config using flat key names (sha512_iterations, argon2_time_cost/argon2_memory_cost/argon2_parallelism, enable_hkdf, balloon_iteratio...
🚨 CVE-2026-81705
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
🎖@cveNotify
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.
🎖@cveNotify
GitHub
File password printed in cleartext by the --debug argv dump for bundled and abbreviated option spellings
Under `--debug`, openssl-encrypt prints its own argv, routing secret-valued options through a redaction chokepoint first. `sanitize_argv_for_debug` selected what to redact by **exact string members...
🚨 CVE-2026-81706
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.
🎖@cveNotify
GitHub
Contact stored under an own identity's name silently substitutes its keys when the identity is deleted
### Summary
`IdentityStore.get_by_name` resolves `base_path/<name>` (own identities) before `contacts/<name>`, but `add_identity` chose the destination directory purely from `is_own_id...
`IdentityStore.get_by_name` resolves `base_path/<name>` (own identities) before `contacts/<name>`, but `add_identity` chose the destination directory purely from `is_own_id...
🚨 CVE-2026-81707
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.
🎖@cveNotify
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.
🎖@cveNotify
GitHub
Imported identity email printed unsanitized lets ANSI escapes forge the fingerprint verification line
### Summary
`Identity.import_public` validated the identity `name` but accepted the `email` field of an imported identity document completely raw, and the CLI printed it to the terminal unsanitize...
`Identity.import_public` validated the identity `name` but accepted the `email` field of an imported identity document completely raw, and the CLI printed it to the terminal unsanitize...
🚨 CVE-2026-81714
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).
🎖@cveNotify
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).
🎖@cveNotify
GitHub
Plugin-signing trust-anchor enrollment accepts a partial/suffix fingerprint match
enroll_trust_key (F21, gitlab#136) bound a plugin-signing trust anchor using suffix-tolerant fingerprint matching, so an operator confirming a short (forgeable, ~32-bit) GPG key id could enrol an a...
🚨 CVE-2026-81715
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.
🎖@cveNotify
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.
🎖@cveNotify
GitHub
Keyserver bearer token echoed in cleartext in the --debug argv dump
The keyserver bearer token passed as the positional 'keyserver set-token <token>' was not redacted by sanitize_argv_for_debug (F17, gitlab#134), so it was printed in cleartext to stde...
🚨 CVE-2026-81716
openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ_FILES permission could read or write another plugin's directory that merely shares a name prefix (e.g., .../plugins/foobar matching allowed .../plugins/foo), breaking per-plugin isolation within the same user. Fixed by matching each allowed directory exactly or with a trailing path separator.
🎖@cveNotify
openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ_FILES permission could read or write another plugin's directory that merely shares a name prefix (e.g., .../plugins/foobar matching allowed .../plugins/foo), breaking per-plugin isolation within the same user. Fixed by matching each allowed directory exactly or with a trailing path separator.
🎖@cveNotify
GitHub
Plugin sandbox authorizes sibling directories via a bare path prefix (cross-plugin access)
PluginSandbox._is_safe_path (F15, gitlab#133) authorized file access with a bare string-prefix match, so a sandboxed plugin without READ_FILES could read/write another plugin's directory that m...
🚨 CVE-2026-81717
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an offline rainbow-table attack.
🎖@cveNotify
openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an offline rainbow-table attack.
🎖@cveNotify
GitHub
Portable USB: integrity check misses added/autorun files and uses a fixed hardcoded KDF salt
Two medium-severity weaknesses in the portable USB drive feature (gitlab#132, scan findings F13 + F14/F19). The module's threat model treats the removable drive as untrusted (attacker has physi...