Is CVE-2026-81702 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81702 being exploited in the wild.

How severe is CVE-2026-81702?

Critical severity, with a CVSS score of 9.8, published 27 August 2026.

Which products and versions are affected?

Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2026-81702?

Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81702 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-81702?

Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81702: openssl_encrypt key substitution in identity loading

CVE-2026-81702 · Severity: critical · CVSS 9.8 · Published 2026-08-27

openssl_encrypt is a cryptographic tool used to encrypt and digitally sign files using public-key authentication. The software fails to validate that loaded public keys match their claimed fingerprints, allowing attackers to swap legitimate keys with their own while the system displays the original fingerprint. This enables attackers to silently decrypt files intended for others and forge valid-appearing signatures, compromising the authenticity of encrypted communications.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81702 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81702 being exploited in the wild.
How severe is CVE-2026-81702?: Critical severity, with a CVSS score of 9.8, published 27 August 2026.
Which products and versions are affected?: Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81702?: Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81702 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-81702?: Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openssl-encrypt (PyPI): upgrade to 1.4.9 or later
```
pip install "openssl-encrypt>=1.4.9"
```

Technical details

The vulnerability is insufficient verification of data authenticity (CWE-345) in the Identity.load() function. When loading identities from identity.json, the code trusts the stored fingerprint field without re-deriving it from the actual .pem public-key files. This contrasts with the import_public() path, which calls check_fingerprint_consistency() and rejects mismatches. An attacker who can supply or modify the identity store (shared directory, extracted archive, or attacker-controlled --identity-store path) can replace .pem files with attacker-controlled keys while keeping the original fingerprint claim in identity.json. The attack succeeds because encrypt uses the swapped ML-KEM key, decrypt verifies signatures against the fake ML-DSA key, and add_identity performs TOFU checks against the claimed (not recomputed) fingerprint. The fix in 1.4.9 enforces fingerprint re-derivation on load, closing the attack.

Affected products

jahlives openssl_encrypt before 1.4.9

Identifiers

CVE-2026-81702
PYSEC-2026-3962

Timeline

2026-08-27: disclosed: CVE-2026-81702 published
2026-08-12: patched: Version 1.4.9 released with fingerprint re-derivation fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.