CVE-2026-81714
Received Received - Intake

openssl-encrypt Plugin Trust Anchor Collision Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81714
EUVD
EUVD-2026-67064

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.8 (inc)
openssl openssl_encrypt 1.4.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81714 affects openssl_encrypt versions <= 1.4.8 due to improper verification of cryptographic signatures. The system uses suffix-tolerant fingerprint matching to confirm GPG key IDs, allowing attackers to forge short (~32-bit) key IDs that collide with legitimate ones. This tricks the system into enrolling a malicious trust anchor, which can then vouch for malicious plugins under the ENFORCE signature policy.

Version 1.4.9 fixes this by requiring exact matching of the full primary-key fingerprint during enrollment.

Detection Guidance

Check the installed version of openssl_encrypt using pip show openssl-encrypt. If the version is <= 1.4.8, the system is vulnerable. Compare the output against the fixed version 1.4.9.

Impact Analysis

An attacker could exploit this to enroll a malicious GPG key as a trusted anchor. This would allow them to sign and distribute malicious plugins that appear legitimate under the ENFORCE signature policy, potentially leading to unauthorized code execution or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized plugin execution, violating integrity and confidentiality requirements in standards like GDPR and HIPAA. Compromised systems may fail compliance audits due to inadequate signature verification controls.

Mitigation Strategies

Upgrade openssl_encrypt to version 1.4.9 or later immediately. Verify the upgrade by running pip show openssl-encrypt again. Ensure no plugins are trusted under the ENFORCE policy until the upgrade is confirmed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81714. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart