CVE-2026-81697
Received Received - Intake

openssl-encrypt CWD-relative config file flaw enables weak KDF downgrade

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 contain a CWD-relative configuration file resolution flaw in crypt_settings.py, where CONFIG_FILE (originally the absolute per-user path ~/.crypt_settings.json) is reassigned at line 84 to the bare relative name 'crypt_settings.json'. As a result, the legacy Tk GUI's SettingsTab reads and writes KDF settings from crypt_settings.json in the process launch (current working) directory instead of the user's home directory. An attacker who plants a malicious crypt_settings.json (e.g. sha256:1 with all memory-hard KDFs disabled) can silently downgrade encryption performed in that GUI session to roughly one hash round, bypassing the weak-KDF preflight and enabling offline brute-force attacks against the resulting ciphertext. Fixed in 1.4.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81697
EUVD
EUVD-2026-67053

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability affects the openssl-encrypt package versions 1.4.8 and earlier. It involves a flaw where the legacy GUI reads KDF settings from a file named crypt_settings.json in the current working directory instead of the intended per-user path ~/.crypt_settings.json. An attacker can plant a malicious crypt_settings.json file with weak KDF settings, causing encryption to use only one hash round. This makes encrypted files vulnerable to offline brute-force attacks.

Detection Guidance

Check if the openssl-encrypt package version is 1.4.8 or earlier. Run: pip show openssl-encrypt. If installed, verify the presence of crypt_settings.json in the current working directory during GUI usage. Inspect crypt_settings.py for line 84 where CONFIG_FILE is reassigned to 'crypt_settings.json'.

Impact Analysis

If you use the vulnerable openssl-encrypt GUI to encrypt files, an attacker could trick you into running the GUI in a directory containing a malicious crypt_settings.json file. This would silently downgrade your encryption strength, allowing the attacker to later brute-force your encrypted files offline. The impact is higher if you handle sensitive data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to encrypted sensitive data due to weak encryption. Organizations using the vulnerable software may fail to meet encryption or data protection requirements, potentially leading to legal or regulatory penalties.

Mitigation Strategies

Upgrade the openssl-encrypt package to version 1.4.9 or later using pip install --upgrade openssl-encrypt. Remove any crypt_settings.json files in current working directories. Avoid using the legacy Tk GUI until updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart