CVE-2026-81705

Analyzed Analyzed - Analysis Complete

Password Leak in OpenSSL-Encrypt Debug Logs

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81705

EUVD

EUVD-2026-67061

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability in openssl-encrypt versions before 1.4.9 causes file passwords to be exposed in cleartext when using the --debug flag. The redaction mechanism fails to handle certain command-line argument spellings like bundled short options (-apHunter2) or abbreviated long options (--passw), printing passwords to stderr where they can be captured in logs or terminal output.

Detection Guidance

Check if openssl-encrypt versions <= 1.4.8 are installed by running: openssl-encrypt --version. If affected, review debug logs or stderr output for cleartext passwords in command arguments. Look for non-standard spellings like -apHunter2 or --passw in logs.

Impact Analysis

If you used affected password spellings with openssl-encrypt before 1.4.9, your passwords may have been logged in plaintext. Attackers with access to stderr output (CI logs, terminal scrollback, or GUI debug logs) could recover these passwords, leading to unauthorized access to encrypted files or systems.

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of sensitive data like passwords. Exposure of plaintext passwords in logs may lead to breaches of GDPR (data protection) or HIPAA (health information privacy), potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Upgrade openssl-encrypt to version 1.4.9 or later. Rotate any passwords used with affected command spellings. Review logs for past exposure and revoke compromised credentials.

Hi! I’m here to help you understand CVE-2026-81705. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70