CVE-2026-81717

Analyzed Analyzed - Analysis Complete

USB Drive Encryption Key Weakness in openssl-encrypt

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VulnCheck

Description

openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an offline rainbow-table attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81717

EUVD

EUVD-2026-67067

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

The vulnerability in openssl_encrypt (pip package openssl-encrypt) before version 1.4.9 affects its portable USB drive feature. It allows an attacker with physical write access to bypass integrity checks by adding unauthorized files, such as malicious autorun payloads, which go undetected because the verification only checks files listed in a manifest. Additionally, the software uses a fixed, globally constant salt for key derivation when a per-drive salt file is missing, weakening encryption and enabling offline rainbow-table attacks.

Detection Guidance

To detect this vulnerability, check the version of the openssl-encrypt package. If you are using a version prior to 1.4.9, your system is vulnerable. Run the command: pip show openssl-encrypt to check the installed version.

Impact Analysis

An attacker with physical access to a removable drive could add malicious files, such as autorun payloads, which may execute automatically when the drive is connected to a system. The weak encryption key derivation using a fixed salt could allow attackers to decrypt sensitive data stored on the drive using precomputed rainbow tables.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data stored on portable drives, potentially violating data protection requirements under GDPR and HIPAA. The lack of proper integrity checks and weak encryption may result in non-compliance with data security and encryption standards.

Mitigation Strategies

Immediately update the openssl-encrypt package to version 1.4.9 or later using the command: pip install --upgrade openssl-encrypt. This update addresses the integrity bypass and fixes the weak key derivation.

Hi! I’m here to help you understand CVE-2026-81717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70