CVE-2026-81702
Last modified
CVE-2026-81702 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid..
Description
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-81702?
How severe is CVE-2026-81702?
How do I fix CVE-2026-81702?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-81697openssl_encrypt (pip package openssl-encrypt) versions <= 1.…5.5
- CVE-2026-81698openssl_encrypt versions before 1.4.9 contain a shell inject…7.5
- CVE-2026-81699openssl_encrypt versions before 1.4.9 fail to properly valid…7.5
- CVE-2026-8170The mv, cp, and rm file utilities exposed within the Extreme…8.7
- CVE-2026-81700openssl_encrypt versions before 1.4.9 contain a signature ve…9.8
- CVE-2026-81701openssl_encrypt versions before 1.4.9 use a denylist to iden…9.8
- CVE-2026-81703openssl_encrypt versions before 1.4.9 fail to validate encry…5.5
- CVE-2026-81704openssl_encrypt versions before 1.4.9 contain a weak key der…7.5
- CVE-2026-81705openssl-encrypt before 1.4.9 fails to redact the file passwo…7.5
- CVE-2026-81706openssl_encrypt before 1.4.9 fails to prevent namespace coll…6.8
- CVE-2026-81707openssl_encrypt before 1.4.9 fails to sanitize the email fie…9.8
- CVE-2026-81714openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use…7
Are you affected by CVE-2026-81702?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST