Is CVE-2026-81689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81689 being exploited in the wild.

How severe is CVE-2026-81689?

High severity, with a CVSS score of 7.5, published 27 August 2026.

Which products and versions are affected?

Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2026-81689?

Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81689 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81689?

Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81689: openssl_encrypt weak password key derivation in pepper wrap

CVE-2026-81689 · Severity: high · CVSS 7.5 · Published 2026-08-27

openssl_encrypt is a Python library for encrypting sensitive data using password-protected keys. Versions before 1.4.9 derive encryption keys using an unsalted, non-memory-hard algorithm, allowing attackers with access to encrypted pepper blobs to perform offline password guessing attacks at hardware speed. A compromised or malicious keyserver can precompute a single dictionary table to recover user passwords across all accounts simultaneously.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81689 being exploited in the wild.
How severe is CVE-2026-81689?: High severity, with a CVSS score of 7.5, published 27 August 2026.
Which products and versions are affected?: Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81689?: Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81689 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81689?: Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-encrypt (PyPI): upgrade to 1.4.9 or later
```
pip install "openssl-encrypt>=1.4.9"
```

Technical details

The vulnerability is a weak cryptographic key derivation (CWE-916) in the remote-pepper feature. Affected versions derive the AES-GCM wrap key using either unsalted HKDF-SHA256 or bare SHA-256 of the user's password, with no per-blob salt or additional authenticated data (AAD). This allows identical wrap keys for the same password across all users and files. An attacker with read access to wrapped pepper blobs (stored on a keyserver) can precompute a single dictionary table and perform fleet-wide offline password guessing; the non-memory-hard derivation runs at hardware speed (~2 SHA-256 operations per guess). Fix 1.4.9 introduces v2 wrapped-pepper blobs using Argon2id key derivation with per-blob random salt and includes pepper name as AAD, making offline guessing infeasible. Legacy blobs remain readable for backward compatibility.

Affected products

jahlives openssl_encrypt before 1.4.9

Identifiers

CVE-2026-81689
PYSEC-2026-3959

Timeline

2026-08-12: disclosed
2026-08-27: advisory
2026-08-27: patched: Version 1.4.9 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.