CVE-2026-81706
Last modified
CVE-2026-81706 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker's keys, enabling silent key substitution for encrypted files.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| jahlives | openssl_encrypt | < 1.4.9 |
References
Timeline
- Published
- Last Modified
- Status
- Undergoing Analysis
Frequently Asked Questions
What is CVE-2026-81706?
How severe is CVE-2026-81706?
How do I fix CVE-2026-81706?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-81700openssl_encrypt versions before 1.4.9 contain a signature ve…9.8
- CVE-2026-81701openssl_encrypt versions before 1.4.9 use a denylist to iden…9.8
- CVE-2026-81702openssl_encrypt before 1.4.9 fails to re-derive and validate…9.8
- CVE-2026-81703openssl_encrypt versions before 1.4.9 fail to validate encry…5.5
- CVE-2026-81704openssl_encrypt versions before 1.4.9 contain a weak key der…7.5
- CVE-2026-81705openssl-encrypt before 1.4.9 fails to redact the file passwo…7.5
- CVE-2026-81707openssl_encrypt before 1.4.9 fails to sanitize the email fie…9.8
- CVE-2026-81714openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use…7
- CVE-2026-81715openssl_encrypt (pip package openssl-encrypt) versions <= 1.…3.3
- CVE-2026-81716openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9…5.2
- CVE-2026-81717openssl_encrypt (pip package openssl-encrypt) before 1.4.9 c…3.5
- CVE-2026-81718openssl_encrypt versions before 1.4.9 use under-parameterize…7.5
Are you affected by CVE-2026-81706?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST