Is CVE-2026-81688 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81688 being exploited in the wild.

How severe is CVE-2026-81688?

High severity, with a CVSS score of 7.5, published 27 August 2026.

Which products and versions are affected?

openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2026-81688?

Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81688 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81688?

Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81688: openssl_encrypt plaintext confirmation oracle via unkeyed SHA-256

CVE-2026-81688 · Severity: high · CVSS 7.5 · Published 2026-08-27

openssl_encrypt is a Python library for encrypting files. Versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the file header, allowing attackers to confirm guessed passwords offline or identify identical files across multiple backups without ever knowing the encryption key. This undermines the confidentiality protections of the encryption.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81688 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81688 being exploited in the wild.
How severe is CVE-2026-81688?: High severity, with a CVSS score of 7.5, published 27 August 2026.
Which products and versions are affected?: openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81688?: Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81688 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81688?: Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-encrypt (PyPI): upgrade to 1.4.9 or later
```
pip install "openssl-encrypt>=1.4.9"
```

Technical details

The vulnerability is a missing encryption of sensitive data (CWE-311) in which every encrypted file contains hashes.original_hash = SHA-256(plaintext) in the cleartext file header metadata. Because the hash is unkeyed and readable without the password, an attacker can perform offline plaintext confirmation by hashing candidate plaintexts and comparing them to the stored hash, or fingerprint identical plaintexts across separately encrypted files. The hash is cryptographically redundant because the cipher already authenticates plaintext via AEAD tags, Fernet HMAC, Camellia encrypt-then-MAC, or other mechanisms. Fix: version 1.4.9 removes the unkeyed plaintext hash from all encryption paths; decryption remains tolerant of legacy files that still contain it.

Affected products

openssl_encrypt openssl_encrypt before 1.4.9

Identifiers

CVE-2026-81688
PYSEC-2026-3795

Timeline

2026-08-12: disclosed
2026-08-12: patched: patched in version 1.4.9
2026-08-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.