Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-81701: OpenSSL Encrypt before 1.4.9 lets malicious plugins run
CVE-2026-81701 · published 7 days ago
Summary
Versions of OpenSSL Encrypt older than 1.4.9 do not properly check plugins, so an attacker could add a fake plugin to the standard plugin folders and have it executed. This could let the attacker run any code they want, potentially exposing passwords and encryption keys. Upgrade to OpenSSL Encrypt 1.4.9 or later and only allow trusted, signed plugins in those directories.
Original advisory text
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature...
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-wxx9-p55f-w...
- https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-arbitrary-code...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81701... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-81701 Vendor Advisory
Severity
9.3
Critical
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.3 (NVD)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published27 Aug 2026
Updated2 Sep 2026
First seen27 Aug 2026
Monitor software like this
Free during beta