Is CVE-2026-81718 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81718 being exploited in the wild.

How severe is CVE-2026-81718?

High severity, with a CVSS score of 7.5, published 27 August 2026.

Which products and versions are affected?

Jahlives Openssl Encrypt before 1.4.9.

Is there a fix for CVE-2026-81718?

A patch was published on 2026: Version 1.4.9 released with Argon2id and AEAD-based fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81718 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81718?

Check whether you run Jahlives Openssl Encrypt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81718: openssl_encrypt weak PBKDF2 parameters in keyfile encryption

CVE-2026-81718 · Severity: high · CVSS 7.5 · Published 2026-08-27

openssl_encrypt is a Python library for encrypting files and protecting cryptographic keys. Versions before 1.4.9 use insufficiently strong password-based key derivation (PBKDF2 with only 100,000 iterations) to protect stored private keys and verify passwords. An attacker who gains access to encrypted keyfiles or data files can efficiently brute-force the passwords offline using GPU or specialized hardware, potentially compromising long-term cryptographic keys and encrypted data.

Technologies: Jahlives Openssl Encrypt. Vendors: Jahlives.

Quick answers

Is CVE-2026-81718 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81718 being exploited in the wild.
How severe is CVE-2026-81718?: High severity, with a CVSS score of 7.5, published 27 August 2026.
Which products and versions are affected?: Jahlives Openssl Encrypt before 1.4.9.
Is there a fix for CVE-2026-81718?: A patch was published on 2026: Version 1.4.9 released with Argon2id and AEAD-based fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81718 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81718?: Check whether you run Jahlives Openssl Encrypt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a weak cryptographic parameter implementation (CWE-326) in the PBKDF2-HMAC-SHA256 key derivation function used in two contexts: (1) protecting PQC (post-quantum cryptography) keyfiles with only 100,000 iterations, falling below OWASP security recommendations of 600,000+ iterations; and (2) verifying dual-encryption file passwords using only 10,000 iterations stored in cleartext metadata. An attacker with network access can obtain keyfiles or encrypted files, then perform offline password brute-force attacks accelerated by GPUs or ASICs. The fix, released in version 1.4.9, transitions new keyfiles to Argon2id (a stronger KDF) while maintaining backward compatibility with existing PBKDF2-protected keyfiles, and removes reliance on the weak verifier in favor of AEAD authentication tags.

Affected products

jahlives openssl_encrypt before 1.4.9

Timeline

2026-08-27: disclosed: CVE-2026-81718 published; GitHub advisory GHSA-fmjx-p826-6fvr published 2026-08-12
2026: patched: Version 1.4.9 released with Argon2id and AEAD-based fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.