CVE-2026-81701: jahlives openssl_encrypt

CVSS 9.8 (critical) · published 2026-08-27

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.

Affected products (NVD): jahlives openssl_encrypt

Fixed in (NVD): 1.4.9

Weakness: CWE-347

Source: NVD CVE-2026-81701

References

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-wxx9-p55f-wm34
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-arbitrary-code-execution-via-unsigned-plugin

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.