CVE-2026-81690

openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on the hash side binds only the final path component. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which CPython loads in preference to recompiling the clean .py). The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).

• CWE-59

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-hw7h-wqf5-6crxVendor Advisory
• https://www.vulncheck.com/advisories/verify-usb-before-1.4.9-symlink-directory-traversal-code-executionThird Party Advisory

Published

Aug 27, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81685openssl_encrypt versions before 1.4.9 fail to sanitize recov…3.3
• CVE-2026-81686openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bu…5.5
• CVE-2026-81687openssl_encrypt versions before 1.4.9 fail to enforce a time…5.5
• CVE-2026-81688openssl_encrypt versions before 1.4.9 store an unkeyed SHA-2…7.5
• CVE-2026-81689openssl_encrypt versions before 1.4.9 derive the remote-pepp…7.5
• CVE-2026-8169ExtremeXOS (EXOS) uses a challenge-response mechanism to aut…8.7
• CVE-2026-81691openssl_encrypt versions before 1.4.9 fail to validate serve…7.5
• CVE-2026-81692openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and ea…7.5
• CVE-2026-81693openssl_encrypt before 1.4.9 fails to validate the total fie…7.5
• CVE-2026-81694openssl-encrypt (pip package, versions <= 1.4.8) fails to sa…3.3
• CVE-2026-81695openssl_encrypt versions before 1.4.9 fail to escape attacke…3.3
• CVE-2026-81696openssl_encrypt versions before 1.4.9 fail to sanitize termi…3.3