CVE-2026-81683

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps only its path in SharedPreferences, and migrates/scrubs existing cleartext values.

• CWE-312

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-r8gw-6hfj-98jwVendor Advisory
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-plaintext-private-key-storageThird Party Advisory

Published

Aug 27, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81678AVideo before 24.0 contains a server-side request forgery vu…7.5
• CVE-2026-81679OpenRemote versions before 1.28.0 contain a cross-realm info…7.7
• CVE-2026-8168Uncontrolled recursion in the SVG parser and renderer of the…7.1
• CVE-2026-81680openssl_encrypt versions before 1.4.9 fail to authenticate r…5.3
• CVE-2026-81681openssl_encrypt (pip package openssl-encrypt) versions <= 1.…4.6
• CVE-2026-81682openssl_encrypt versions before 1.4.9 contain an insecure fi…6.2
• CVE-2026-81684In openssl_encrypt (pip package openssl-encrypt) versions <=…6.2
• CVE-2026-81685openssl_encrypt versions before 1.4.9 fail to sanitize recov…3.3
• CVE-2026-81686openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bu…5.5
• CVE-2026-81687openssl_encrypt versions before 1.4.9 fail to enforce a time…5.5
• CVE-2026-81688openssl_encrypt versions before 1.4.9 store an unkeyed SHA-2…7.5
• CVE-2026-81689openssl_encrypt versions before 1.4.9 derive the remote-pepp…7.5