CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass

What is CVE-2026-81700?

CVE-2026-81700 is a critical vulnerability in Jahlives Openssl Encrypt, published on 27 Aug 2026.

Official description

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.

Weakness: CWE-347

Which versions are affected by CVE-2026-81700?

1 open source package ship an affected version, including openssl-encrypt. It affects 1 product.

Products include Jahlives Openssl Encrypt.

How do I fix CVE-2026-81700?

Upgrade openssl-encrypt to 1.4.9 or later.

Is CVE-2026-81700 being exploited?

There is no known exploitation of CVE-2026-81700 in the wild and no public exploit code.

Other vulnerabilities in Jahlives Openssl Encrypt

• CVE-2026-81680 openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal Critical 9.3
• CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage Critical 9.3
• CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata Critical 9.3
• CVE-2026-81694 openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command Critical 9.3
• CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id Critical 9.3

All Jahlives Openssl Encrypt vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-8379-29x8-jjmf, GHSA-x38r-8wf3-q9hq, PYSEC-2026-3777.