CVE-2026-81683 openssl_encrypt before 1.4.9 Plaintext Private Key Storage

What is CVE-2026-81683?

CVE-2026-81683 is a high-severity vulnerability in Jahlives Openssl Encrypt, published on 27 Aug 2026.

Official description

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.

Weakness: CWE-312

Which versions are affected by CVE-2026-81683?

1 open source package ship an affected version, including openssl-encrypt. It affects 1 product.

Products include Jahlives Openssl Encrypt.

How do I fix CVE-2026-81683?

Upgrade openssl-encrypt to 1.4.9 or later.

Is CVE-2026-81683 being exploited?

There is no known exploitation of CVE-2026-81683 in the wild and no public exploit code.

Other vulnerabilities in Jahlives Openssl Encrypt

• CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal Critical 9.3
• CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage Critical 9.3
• CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata Critical 9.3
• CVE-2026-81694 openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command Critical 9.3
• CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id Critical 9.3

All Jahlives Openssl Encrypt vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-p8vp-h9v2-m833, GHSA-r8gw-6hfj-98jw, PYSEC-2026-3792.