CVE-2026-81715
Received Received - Intake

openssl-encrypt Bearer Token Exposure via Debug Logging

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81715
EUVD
EUVD-2026-67065

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openssl openssl_encrypt to 1.4.8 (inc)
openssl openssl_encrypt 1.4.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability affects the openssl_encrypt pip package versions 1.4.8 or earlier. When using the --debug flag, the keyserver bearer token passed as an argument is not redacted in the debug output. This causes the token to appear in cleartext in stderr logs and terminal history, potentially exposing credentials.

Detection Guidance

Check if the openssl-encrypt package version is <= 1.4.8 by running pip show openssl-encrypt or pip list. If using --debug, inspect stderr output for exposed keyserver bearer tokens in logs or terminal history.

Impact Analysis

If you use the affected package with --debug, your keyserver bearer token could be exposed in logs or terminal history. This may lead to unauthorized access to keyserver resources if the token is captured by attackers.

Mitigation Strategies

Upgrade the openssl-encrypt package to version 1.4.9 or later using pip install --upgrade openssl-encrypt. Avoid using the --debug flag to prevent token exposure in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart