CVE-2026-81706: openssl_encrypt namespace collision in IdentityStore allowing key substitution

CVE-2026-81706 · Severity: medium · CVSS 6.8 · Published 2026-08-27

openssl_encrypt is a file encryption tool that manages identities and contacts for key-based encryption. A flaw in versions before 1.4.9 allows attackers to create hidden duplicate contact entries with the same name as a legitimate user identity. When the user later deletes their own identity (a routine operation after key rotation), the hidden contact surfaces and silently substitutes the attacker's encryption key, causing files encrypted to that trusted name to actually use the attacker's key without the user's knowledge.

Technologies: Jahlives Openssl Encrypt, openssl-encrypt (PyPI). Vendors: Jahlives, PyPI.

Quick answers

Is CVE-2026-81706 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81706 being exploited in the wild.
How severe is CVE-2026-81706?
Medium severity, with a CVSS score of 6.8, published 27 August 2026.
Which products and versions are affected?
Jahlives Openssl Encrypt before 1.4.9; openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2026-81706?
Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81706 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-81706?
Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openssl-encrypt (PyPI): upgrade to 1.4.9 or later
    pip install "openssl-encrypt>=1.4.9"

Technical details

The vulnerability is a namespace collision (CWE-706) in the IdentityStore component where the add_identity function does not validate whether a name being imported as a contact already exists as an own identity. The get_by_name lookup checks own identities (base_path/<name>) before contacts (contacts/<name>), making shadowed contacts invisible while the own identity exists. The delete_identity function removed only the own identity without checking for shadowed contacts, leaving the attacker's contact in place. Upon deletion, get_by_name then resolves to the attacker's keys, enabling silent key substitution for encryption operations. The vulnerability requires that an attacker first gets their contact bundle imported under a chosen name, then waits for the user to delete their own identity. The fix in 1.4.9 prevents the collision by refusing to store a name that exists as the other kind, removes both locations on deletion, and surfaces collisions in the identity list output.

Affected products

  • jahlives openssl_encrypt before 1.4.9

Identifiers

  • CVE-2026-81706
  • PYSEC-2026-3781

Timeline

  • 2026-08-27: disclosed
  • 2026-08-12: patched: Version 1.4.9 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.