# CVE-2026-81717: openssl_encrypt USB drive integrity bypass with fixed KDF salt

Source: https://junglewise.ai/threats/cve-2026-81717-openssl-encrypt-usb-drive-integrity-bypass-with-fixed-kdf-salt  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81717 · Severity: medium · CVSS 4 · Published 2026-08-27

openssl_encrypt is a Python library that provides encryption features, including the ability to create secure portable USB drives. The library fails to detect files added to a USB drive and uses a hardcoded encryption salt, allowing an attacker with physical access to a USB drive to inject malicious files (including autorun payloads) undetected and potentially conduct offline password attacks against the drive encryption.

Technologies: [Jahlives Openssl Encrypt](https://junglewise.ai/threats/technologies/openssl-encrypt), [openssl-encrypt (PyPI)](https://junglewise.ai/threats/technologies/pypi-openssl-encrypt). Vendors: [Jahlives](https://junglewise.ai/threats/vendors/jahlives), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-81717 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81717 being exploited in the wild.

**How severe is CVE-2026-81717?** Medium severity, with a CVSS score of 4, published 27 August 2026.

**Which products and versions are affected?** openssl-encrypt (PyPI) ECOSYSTEM:introduced=0,fixed=1.4.9.

**Is there a fix for CVE-2026-81717?** Yes. openssl-encrypt (PyPI): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81717 attacked?** It is attacked with physical access, in a software library.

**Am I affected by CVE-2026-81717?** Check whether you run Jahlives Openssl Encrypt or openssl-encrypt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openssl-encrypt (PyPI): upgrade to 1.4.9 or later

  ```sh
  pip install "openssl-encrypt>=1.4.9"
  ```


## Technical details

The vulnerability consists of two related weaknesses in the portable USB drive feature. First, USBDriveCreator._verify_integrity_file only validates files listed in the stored manifest; files added to the drive after creation—including root-level autorun payloads—are not detected and integrity verification incorrectly passes. Second, the library uses a globally constant, hardcoded KDF salt (_LEGACY_FIXED_SALT) when deriving encryption keys for drives lacking a per-drive salt file, defeating precomputation resistance and enabling offline rainbow-table attacks. Both weaknesses assume the threat model where an attacker has physical write access to the removable USB drive. The fix, available in version 1.4.9, adds bidirectional integrity checks and generates unique per-drive salts for new drives while maintaining backward compatibility with legacy drives.

## Affected products

- openssl_encrypt openssl_encrypt before 1.4.9

## Identifiers

- CVE-2026-81717
- PYSEC-2026-3801

## Timeline

- 2026-08-27: disclosed

## References

- [https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8jx3-27qf-3p97](https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8jx3-27qf-3p97)
- [https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-integrity-bypass-via-added-files](https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-integrity-bypass-via-added-files)

## Related threats

- [openssl_encrypt KDF cost parameter validation bypass](https://junglewise.ai/threats/cve-2026-81721-openssl-encrypt-kdf-cost-parameter-validation-bypass)
- [openssl_encrypt memory exhaustion in identity file protection block](https://junglewise.ai/threats/cve-2026-81720-openssl-encrypt-memory-exhaustion-in-identity-file-protection)
- [openssl_encrypt arbitrary code execution via plugin signature bypass](https://junglewise.ai/threats/cve-2026-81719-openssl-encrypt-arbitrary-code-execution-via-plugin-signature)
- [openssl_encrypt weak PBKDF2 parameters in keyfile encryption](https://junglewise.ai/threats/cve-2026-81718-openssl-encrypt-weak-pbkdf2-parameters-in-keyfile-encryption)
- [openssl-encrypt path traversal in PluginSandbox](https://junglewise.ai/threats/cve-2026-81716-openssl-encrypt-path-traversal-in-pluginsandbox)