CVE-2026-81681

Analyzed Analyzed - Analysis Complete

Encrypted USB Workspace Cleartext Storage in openssl-encrypt

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VulnCheck

Description

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption key is never applied to it. A user who trusts the branding and places files in the workspace leaves them unencrypted on the removable media, so an attacker with physical access to the media can read the sensitive files. Fixed in 1.4.9, which seals the workspace into an authenticated AES-256-GCM vault.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81681

EUVD

EUVD-2026-67037

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-311	The product does not encrypt sensitive or critical information before storage or transmission.

Attack-Flow Graph

Executive Summary

The openssl_encrypt package versions <= 1.4.8 falsely claim to provide AES-256-GCM encryption for a portable USB workspace. It writes a marker declaring the workspace encrypted but stores the actual workspace directory in cleartext. The derived encryption key is never applied to the data, leaving files unencrypted on the removable media.

Detection Guidance

Check if you have openssl_encrypt version <= 1.4.8 installed by running: pip show openssl-encrypt. If installed, verify if the workspace directory contains unencrypted files despite the 'Encrypted USB Workspace' marker. Inspect the USB drive for a cleartext workspace folder.

Impact Analysis

If you use this package and trust its branding, you may store sensitive files in the workspace believing they are encrypted. An attacker with physical access to the USB drive can read these unencrypted files. The vulnerability allows unauthorized access to confidential data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations requiring encryption of sensitive data. Unencrypted storage of personal or health information on removable media violates data protection standards, risking legal penalties and data breaches.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later using: pip install --upgrade openssl-encrypt. Ensure all sensitive files are re-encrypted in the new version. Avoid storing sensitive data in the workspace until the upgrade is complete.

Hi! I’m here to help you understand CVE-2026-81681. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70