# CVE-2026-81697: openssl-encrypt KDF downgrade via CWD-relative configuration

Source: https://junglewise.ai/threats/cve-2026-81697-openssl-encrypt-kdf-downgrade-via-cwd-relative-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81697 · Severity: medium · CVSS 5.5 · Published 2026-08-27

openssl-encrypt is a Python library for encrypting files using strong key derivation and cryptographic hashing. A flaw in versions up to 1.4.8 causes the legacy GUI to read encryption settings from the current working directory instead of the user's home directory, allowing an attacker to plant a malicious configuration file that silently disables strong encryption protections. This enables offline brute-force attacks against encrypted files created during an affected GUI session.

## Quick answers

**Is CVE-2026-81697 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81697 being exploited in the wild.

**How severe is CVE-2026-81697?** Medium severity, with a CVSS score of 5.5, published 27 August 2026.

**Which products and versions are affected?** openssl-encrypt openssl-encrypt <= 1.4.8.

**Is there a fix for CVE-2026-81697?** A patch was published on 2026: Fixed in version 1.4.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81697 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-81697?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CWD-relative configuration file resolution flaw (CWE-426). The crypt_settings.py module defines CONFIG_FILE as an absolute path (~/.crypt_settings.json) at line 20 but reassigns it to a bare relative filename 'crypt_settings.json' at line 84, causing the legacy Tk GUI's SettingsTab to read and write configuration from the process launch directory. An attacker who plants a malicious crypt_settings.json with disabled memory-hard KDFs can reduce encryption to approximately one hash round. Because at least one hash iteration is present, the weak-KDF preflight check does not alert the user. The fix (version 1.4.9) removes the line-84 reassignment and adds a warning when weak KDF configurations are loaded. Attack vector is local; the attacker must be able to place a file in a directory where the application is launched. No network access required.

## Affected products

- openssl-encrypt openssl-encrypt <= 1.4.8

## Timeline

- 2026-08-12: disclosed: GitHub Security Advisory (GHSA-7j2v-g84w-m75v) published
- 2026-08-27: advisory: NVD entry CVE-2026-81697 published
- 2026: patched: Fixed in version 1.4.9

## References

- [https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7j2v-g84w-m75v](https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-7j2v-g84w-m75v)
- [https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-kdf-downgrade-via-cwd-relative-configuration](https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-kdf-downgrade-via-cwd-relative-configuration)