CVE-2026-81684

Analyzed Analyzed - Analysis Complete

OpenSSL-Encrypt Command Line Password Exposure via cmdline

Publication date: 2026-08-27

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument (on both encrypt and decrypt paths) instead of via an environment variable as done for the main password. Any local user can read the steganography password from /proc/<pid>/cmdline for the lifetime of the subprocess. Fixed in 1.4.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81684

EUVD

EUVD-2026-67040

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-214	A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

Executive Summary

This vulnerability affects the openssl_encrypt package versions 0 to 1.4.8. The desktop GUI passes the steganography password to child processes via the command line argument --stego-password instead of using a secure method like an environment variable. This exposes the password to any local user who can read it from /proc/<pid>/cmdline while the subprocess is running.

Detection Guidance

Check running processes for the openssl_encrypt CLI with the --stego-password argument. Use 'ps aux | grep --stego-password' or inspect /proc/<pid>/cmdline for exposed passwords during subprocess execution.

Impact Analysis

Any local user on the system can read the steganography password from /proc/<pid>/cmdline while the vulnerable openssl_encrypt subprocess is running. This could lead to unauthorized access to encrypted data or sensitive information if the password is reused elsewhere.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating confidentiality requirements under GDPR and HIPAA. Organizations using affected versions may fail compliance audits due to inadequate protection of credentials.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later. If unable to upgrade, avoid using the GUI for sensitive operations and use the CLI with environment variables instead.

Hi! I’m here to help you understand CVE-2026-81684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70