CVE-2026-81705

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.

• CWE-532

• https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-jgvm-7jxv-cgccVendor Advisory
• https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-password-cleartext-leak-via-debugThird Party Advisory

Published

Aug 27, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8170The mv, cp, and rm file utilities exposed within the Extreme…8.7
• CVE-2026-81700openssl_encrypt versions before 1.4.9 contain a signature ve…9.8
• CVE-2026-81701openssl_encrypt versions before 1.4.9 use a denylist to iden…9.8
• CVE-2026-81702openssl_encrypt before 1.4.9 fails to re-derive and validate…9.8
• CVE-2026-81703openssl_encrypt versions before 1.4.9 fail to validate encry…5.5
• CVE-2026-81704openssl_encrypt versions before 1.4.9 contain a weak key der…7.5
• CVE-2026-81706openssl_encrypt before 1.4.9 fails to prevent namespace coll…6.8
• CVE-2026-81707openssl_encrypt before 1.4.9 fails to sanitize the email fie…9.8
• CVE-2026-81714openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use…7
• CVE-2026-81715openssl_encrypt (pip package openssl-encrypt) versions <= 1.…3.3
• CVE-2026-81716openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9…5.2
• CVE-2026-81717openssl_encrypt (pip package openssl-encrypt) before 1.4.9 c…3.5