CVE-2026-81701
Received Received - Intake

OpenSSL CLI Plugin Signature Bypass Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81701
EUVD
EUVD-2026-67057

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects openssl_encrypt versions before 1.4.9. It allows unsigned plugins to bypass signature verification by exploiting a denylist-based trust mechanism. Attackers can place malicious unsigned plugins in documented installation paths, such as the top-level plugins/ directory or unknown subdirectories, to achieve arbitrary code execution in the CLI process. This grants access to passwords and cryptographic keys.

Detection Guidance

Check openssl_encrypt version with pip show openssl-encrypt. If version is below 1.4.9, the system is vulnerable. Inspect plugins/ directories for unsigned plugins or files in top-level or unknown subdirectories.

Impact Analysis

If you use openssl_encrypt versions before 1.4.9, attackers could execute arbitrary code on your system through malicious plugins. This could lead to unauthorized access to sensitive data like passwords and cryptographic keys. The impact includes potential data breaches, system compromise, and loss of control over encrypted information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later. Remove any unsigned plugins from plugins/ directories or unknown subdirectories. Avoid placing third-party plugins in top-level plugins/ directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart