CVE-2026-81700

Analyzed Analyzed - Analysis Complete

OpenSSL Encrypt Signature Bypass via Revoked Keys

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81700

EUVD

EUVD-2026-67056

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It allows attackers with revoked or expired signing keys to bypass GPG signature verification by exploiting a flaw in the gpg_runner.verify_detached function. The function only checks VALIDSIG status without verifying REVKEYSIG, EXPKEYSIG, or GPG exit codes, enabling malicious plugin execution in the host process.

Detection Guidance

Check the version of openssl_encrypt installed on your system. If it is below 1.4.9, the system is vulnerable. Use commands like 'pip show openssl-encrypt' or 'pip list' to verify the installed version.

Impact Analysis

If you use openssl_encrypt versions before 1.4.9, attackers could bypass signature checks to execute malicious plugins. This could lead to unauthorized code execution, data breaches, or system compromise. The high CVSS scores (9.3 and 9.8) indicate significant risk of confidentiality, integrity, and availability impacts.

Compliance Impact

This vulnerability could violate compliance requirements for data integrity and protection. GDPR and HIPAA mandate secure data handling and integrity checks. Bypassing signature verification may lead to unauthorized data access or tampering, potentially resulting in non-compliance penalties and loss of trust.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later immediately. Use 'pip install --upgrade openssl-encrypt' to apply the fix. Review and revoke any compromised or expired signing keys used for verification.

Hi! I’m here to help you understand CVE-2026-81700. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70