Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-81700: OpenSSL Encrypt before 1.4.9 may run malicious plugins
CVE-2026-81700 · published 7 days ago
Summary
Versions of OpenSSL Encrypt earlier than 1.4.9 can be tricked into accepting a digital signature that should be rejected because the signing key has been revoked or has expired. This lets an attacker replace a trusted plugin with malicious code that will run inside your application. Upgrade to version 1.4.9 or later, or apply the vendor’s patch, to ensure signature checks properly reject revoked or out‑of‑date keys.
What to do
- Update jahlives openssl_encrypt to version 1.4.9 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
Original advisory text
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without ins...
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-x38r-8wf3-q... vendor-advisory
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-gpg-signature-... third-party-advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81700... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-81700 Vendor Advisory
Severity
9.3
Critical
CVSS 3.1: 9.8 (MITRE)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published27 Aug 2026
Updated2 Sep 2026
First seen27 Aug 2026
Monitor software like this
Free during beta